super-dsh 0.3.1-d → 0.3.1-f

package/client/index.js

@@ -898,6 +898,16 @@ function machineLabelsFrom(list) {
 * roster-probe failure → revert to native + a visible toast, never a page
 * lock).
 *
+* Live-install staleness (2026-10-18): the fusion flag global and the
+* transport script are baked into the SERVED index, so a page that booted
+* before super-dsh was installed runs the freshly hot-loaded client half
+* against a stale page — `fusionPage()` reads false and every switch
+* affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+* is the pure decision behind the client half's heal: one roster answer later,
+* reload the page once. The transport must precede app boot (its upload hook
+* `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+* can never arm a stale page honestly — the page must be re-served.
+*
 * Host-half on purpose: plain TS with every effect injected through
 * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
 * imports it from `dist/` like every other host module. The client half
@@ -1343,6 +1353,22 @@ function switchAffordance(fusion) {
 		hint: FUSION_OFF_HINT
 	};
 }
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+const FUSION_RELOAD_MARKER = "superd.fusion-armed.reload";
+/**
+* The live-install staleness decision (host-half pure so the node tests pin
+* the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+* that distinguishes a page-booted-before-install from a deliberately
+* flag-off deployment — without it the reload would loop forever on every
+* `enabled: false` composition (the client half loads there too).
+*/
+function fusionReloadDecision(input) {
+	if (input.flagPresent) return "armed";
+	if (input.markerPresent) return "already-reloaded";
+	if (input.hubFusion === true) return "reload";
+	if (input.hubFusion === false) return "row-off";
+	return "host-silent";
+}
 /**
 * The active agent's display name for the Hub row's right-edge selector: the
 * roster label of the atom's `activeAgent` key — the name the selector's
@@ -1621,6 +1647,53 @@ function createReadinessWaiter(faces, options = {}) {
 function fusionPage() {
 	return globalThis.__SUPERD_UI_FUSION__ === true;
 }
+/**
+* The sessionStorage marker read (undefined-safe: a storage failure is
+* `false` — the probe then reloads without the loop guard, which only
+* matters for a host that reports fusion but never bakes the flag).
+*/
+function staleReloadMarker() {
+	try {
+		return globalThis.sessionStorage?.getItem(FUSION_RELOAD_MARKER) !== null;
+	} catch {
+		return false;
+	}
+}
+/**
+* Live-install staleness probe (2026-10-18): the ONE call the client entry
+* makes when the page does not carry the fusion flag. A flag-absent page is
+* either a pre-install page (the client half hot-loaded into HTML served
+* before the row mounted — the fresh-install case where the Hub row renders
+* but every switch affordance stays hidden until a manual restart) or a
+* deliberate flag-off deployment (T-E). The roster's additive `hub.fusion`
+* answers which; on an armed host the page re-boots ONCE — the marker keeps
+* a misbehaving host from ever looping the tab. Every failure mode (fetch
+* error, non-OK, old host without the field) degrades to no action: the
+* flag-off shapes below are the honest rendering of an unanswered probe.
+*
+* Fire-and-forget by contract — never throws, never blocks the apply.
+*/
+function probeStaleFusionPage() {
+	(async () => {
+		let hubFusion;
+		try {
+			const response = await fetch("/api/agent-runtime", { credentials: "same-origin" });
+			if (!response.ok) return;
+			hubFusion = (await response.json()).hub?.fusion;
+		} catch {
+			return;
+		}
+		if (fusionReloadDecision({
+			flagPresent: fusionPage(),
+			markerPresent: staleReloadMarker(),
+			hubFusion
+		}) !== "reload") return;
+		try {
+			globalThis.sessionStorage?.setItem(FUSION_RELOAD_MARKER, "1");
+		} catch {}
+		globalThis.location?.reload();
+	})();
+}
 /** The page atom, when the page carries one (it always does on a fusion page). */
 function uiState() {
 	const state = globalThis.__SUPERD_UI_STATE__;
@@ -3880,6 +3953,38 @@ function HubPage() {
 	});
 }
 
+//#endregion
+//#region src/client/pill-geometry.ts
+/**
+* Derive the scroll-invariant offsets from one same-frame measurement.
+* Measuring the DELTAS (not absolute coordinates) is the whole point: they
+* survive any scroll of any ancestor, so nothing needs to re-run while the
+* sidebar scrolls.
+*/
+function measurePillBox(input) {
+	return {
+		dx: input.row.right - input.wrap.left,
+		cy: (input.row.top + input.row.bottom) / 2 - input.wrap.top
+	};
+}
+/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
+const PILL_ROW_INSET = 8;
+/**
+* The pill's placement, wrapper-relative: its right edge sits `inset` px
+* inside the row's right edge, vertically centered on the row
+* (`translateY(-50%)`). `selectorWidth` is the render-time pill width (the
+* mark is present only while an agent is active), so it stays a render
+* concern; the measured box is not.
+*/
+function pillStyle(box, selectorWidth, inset = PILL_ROW_INSET) {
+	return {
+		position: "absolute",
+		left: box.dx - inset - selectorWidth,
+		top: box.cy,
+		transform: "translateY(-50%)"
+	};
+}
+
 //#endregion
 //#region src/client/HubPanelIcon.tsx
 /** Runtime-mark edge inside the selector, and the chevron's own default edge. */
@@ -3893,8 +3998,6 @@ const CHEVRON_SIZE = 14;
 const SELECTOR_HEIGHT = 28;
 const SELECTOR_PAD = 8;
 const SELECTOR_GAP = 4;
-/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
-const ROW_INSET = 8;
 function HubPanelIcon({ size }) {
 	const wide = size <= 16;
 	const rootRef = react.useRef(null);
@@ -3917,16 +4020,25 @@ function HubPanelIcon({ size }) {
 	}, [fusion]);
 	const measure = react.useCallback(() => {
 		const row = rootRef.current?.closest("button") ?? null;
-		if (row === null) {
+		const wrap = selectorRef.current?.parentElement ?? null;
+		if (row === null || wrap === null) {
 			setBox(null);
 			return;
 		}
-		const rect = row.getBoundingClientRect();
-		setBox((prev) => prev !== null && prev.top === rect.top && prev.bottom === rect.bottom && prev.right === rect.right ? prev : {
-			top: rect.top,
-			bottom: rect.bottom,
-			right: rect.right
+		const rowRect = row.getBoundingClientRect();
+		const wrapRect = wrap.getBoundingClientRect();
+		const next = measurePillBox({
+			row: {
+				top: rowRect.top,
+				bottom: rowRect.bottom,
+				right: rowRect.right
+			},
+			wrap: {
+				left: wrapRect.left,
+				top: wrapRect.top
+			}
 		});
+		setBox((prev) => prev !== null && prev.dx === next.dx && prev.cy === next.cy ? prev : next);
 	}, []);
 	react.useLayoutEffect(() => {
 		if (!wide || !switchUi.available) return;
@@ -4036,7 +4148,7 @@ function HubPanelIcon({ size }) {
 		children: [
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(HubGlyph, { size }),
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SuperdToastHost, {}),
-			wide && box !== null && switchUi.available && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__deepseek_ai_dsh_client_ui_primitives.Menu, {
+			wide && switchUi.available && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__deepseek_ai_dsh_client_ui_primitives.Menu, {
 				open,
 				onClose: () => {
 					setOpen(false);
@@ -4057,10 +4169,11 @@ function HubPanelIcon({ size }) {
 					"aria-expanded": open,
 					title: activeLabel === void 0 ? "Agent selector" : `Agent selector: ${activeLabel}`,
 					style: {
-						position: "fixed",
-						left: box.right - ROW_INSET - selectorWidth,
-						top: box.top + (box.bottom - box.top) / 2,
-						transform: "translateY(-50%)",
+						...pillStyle(box ?? {
+							dx: 0,
+							cy: 0
+						}, selectorWidth),
+						visibility: box === null ? "hidden" : "visible",
 						display: "inline-flex",
 						alignItems: "center",
 						justifyContent: "center",
@@ -4105,9 +4218,17 @@ const inject = ["slots"];
 * absent (a composition without the sidebar renders nothing — every seat
 * here is an optional occupant by contract).
 *
-* @param ctx - client root context.
+* Live-install staleness: the fusion flag is baked into the SERVED index, so
+* a page that booted before super-dsh was installed carries no flag even
+* though this very apply is the hot-loaded client half — the Hub row would
+* render with every switch affordance hidden until a manual restart. When
+* the flag is absent the entry probes the roster's `hub.fusion` once and
+* re-boots the page on an armed host (switch.ts `probeStaleFusionPage`; the
+* sessionStorage marker bounds it to one reload per tab session). A flag-off
+* deployment answers `false` and keeps the T-E inert shape with no reload.
 */
 function apply(ctx) {
+	if (!fusionPage()) probeStaleFusionPage();
 	ctx.inject(["slots"], (raw) => {
 		const scope = raw;
 		scope.effect(() => scope.slots.inject("main", () => scope.slots.register({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.1-d",
+  "version": "0.3.1-f",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",

package/superd-hub/dist/a2a-host.d.ts

@@ -10,6 +10,14 @@ export interface A2aHostOptions {
      * ({@link bridgeTypertGateway}).
      */
     nativeGateway?: RawTypertGatewayFace;
+    /**
+     * LAZY provider of ctx0's owner browser Peer (connection.browserPeer) —
+     * 0.2.1 gateways read peer.signal/principal on every invocation. A
+     * provider, not a value: typertGateway mounts before connection, so a
+     * wiring-time read would capture undefined forever; resolution happens
+     * per call, when connection is long live.
+     */
+    nativePeer?: () => unknown;
 }
 /**
  * The RAW typertGateway service face — upstream canonical stream order
@@ -20,8 +28,8 @@ export interface A2aHostOptions {
  * mesh-gateway wire adapters (dual-face, 3rd-argument dispatch).
  */
 export interface RawTypertGatewayFace {
-    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
-    openWireStream(endpoint: string, payload: unknown, uplink: undefined, peer: undefined, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
+    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal, peer: unknown): Promise<unknown>;
+    openWireStream(endpoint: string, payload: unknown, uplink: undefined, peer: unknown, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 }
 /**
  * Bridge one RAW typertGateway instance to Task 2's 3-arg `A2aGateway` face
@@ -38,7 +46,7 @@ export interface RawTypertGatewayFace {
  * @param real - a raw in-process typertGateway instance (ctx0's own or a local world's).
  * @returns the gateway Task 2's service consumes.
  */
-export declare function bridgeTypertGateway(real: RawTypertGatewayFace): A2aGateway;
+export declare function bridgeTypertGateway(real: RawTypertGatewayFace, peer?: unknown): A2aGateway;
 /**
  * Build the gatewayFor resolver Task 2's service consumes: federated table
  * first, shared target registry second, local id-map inversion third,

package/superd-hub/dist/a2a-host.js

@@ -59,10 +59,10 @@ function localKeyOfA6(home, a6) {
  * @param real - a raw in-process typertGateway instance (ctx0's own or a local world's).
  * @returns the gateway Task 2's service consumes.
  */
-export function bridgeTypertGateway(real) {
+export function bridgeTypertGateway(real, peer) {
     return {
-        dispatchRpc: (endpoint, payload, signal) => real.dispatchRpc(endpoint, payload, signal),
-        openWireStream: (endpoint, payload, signal) => real.openWireStream(endpoint, payload, undefined, undefined, signal, new AbortController()),
+        dispatchRpc: (endpoint, payload, signal) => real.dispatchRpc(endpoint, payload, signal, peer),
+        openWireStream: (endpoint, payload, signal) => real.openWireStream(endpoint, payload, undefined, peer, signal, new AbortController()),
     };
 }
 /**
@@ -95,17 +95,17 @@ export function resolveA2aGatewayFor(options) {
             if (key === 'native') {
                 if (options.nativeGateway === undefined)
                     throw new A2aAddressError('unreachable', addr);
-                return bridgeTypertGateway(options.nativeGateway);
+                return bridgeTypertGateway(options.nativeGateway, options.nativePeer?.());
             }
             // The registry's declared GatewayFace (targets.ts) types the stream
             // face as the 3-arg subset, but a LOCAL row's runtime object is the RAW
             // typertGateway instance (world-join.ts registers it verbatim) — re-cast
             // to RawTypertGatewayFace so the bridge above binds the canonical 6-arg
             // positional order instead of the declared subset.
-            const local = getTarget(key)?.gateway;
-            if (local === undefined)
+            const target = getTarget(key);
+            if (target?.gateway === undefined)
                 throw new A2aAddressError('unreachable', addr);
-            return bridgeTypertGateway(local);
+            return bridgeTypertGateway(target.gateway, target.peer);
         }
         // The a6 resolves nowhere — classify the miss (D7): a roster row exists →
         // its plane is down; else the machine decides agent-vs-machine blame.

package/superd-hub/dist/a2a-row.js

@@ -56,12 +56,18 @@ export function wireHubToolRow(ctx, opts = {}) {
         // RAW instance in, bridged at the resolver (fix round 1: one shared
         // bridge in a2a-host.ts covers the native seam AND all local world rows).
         const raw = t.get('typertGateway');
+        // 0.2.1: every invocation reads the caller Peer — ctx0's owner browser
+        // Peer rides the native seam as a LAZY provider: typertGateway mounts
+        // BEFORE connection (the service registers in its constructor), so a
+        // wiring-time value would capture undefined forever; resolution happens
+        // per call, when connection is long live.
+        const nativePeer = () => ctx.get('connection')?.browserPeer;
         // postoffice R4: ONE resolver, ONE ingest, TWO consumers — the initiator
         // service's self-routing leg calls the very same ingest handler the HTTP
         // endpoint calls (protocol-identical by construction). The service takes
         // a LAZY provider: the ingest's delivery face buffers through the
         // service's own buffer leg, so it can only be built after the service.
-        const gatewayFor = resolveA2aGatewayFor({ home, nativeGateway: raw });
+        const gatewayFor = resolveA2aGatewayFor({ home, nativeGateway: raw, nativePeer });
         // Operational journal: the pure modules only format lines; this is
         // where they meet the process console and land in the unit log (4999 rig
         // / dev3 dsh.service journal). NOT ctx.logger: the pack composes no

package/superd-hub/dist/carrier.d.ts

@@ -1,22 +1,24 @@
 import { type WorldRequest, type WorldResponse } from './world-web-server.js';
 import { WorldMuxServer, type MuxFailure } from './world-mux.js';
-/** The three-method face of a world's typertGateway service instance. */
+/** The face of a world's typertGateway service instance the hub forwards through. */
 export interface CarrierGatewayFace {
-    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
+    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal, peer: unknown): Promise<unknown>;
     /**
      * Streams return an async iterable (upstream face is synchronous-returning).
      * Canonical order: (endpoint, payload, uplink, peer, signal, control) — the
-     * carrier passes no peer (ctx0's fence already authenticated the client),
-     * the mux controller's signal, and the controller itself, exactly as the
-     * native gateway's mux wires its own streams.
+     * carrier passes the world's owner browser Peer (0.2.1 gateways read it on
+     * every invocation), the mux controller's signal, and the controller
+     * itself, exactly as the native gateway's mux wires its own streams.
      */
-    openWireStream(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: undefined, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
+    openWireStream(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: unknown, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 }
 export declare function writeJson(res: WorldResponse, status: number, body: string): void;
 /** Deps the forwarding kernel needs to answer for one world's traffic. */
 export interface ForwardOptions {
     /** The addressed world's gateway instance. */
     gateway: CarrierGatewayFace;
+    /** The addressed world's owner browser Peer (0.2.1 invocation identity). */
+    peer?: unknown;
     /** World key addressing the world's published `/api` fetch handler. */
     label: string;
     /** URL prefix this carrier strips before the world sees the request (`/omp`, `/hub`). */
@@ -47,7 +49,7 @@ export declare function forwardWorldFetch(options: {
  */
 export declare function forwardApiCall(options: ForwardOptions, req: WorldRequest, res: WorldResponse): Promise<void>;
 /** One WorldMuxServer bound to `gateway` — the canonical openWireStream wiring in one place. */
-export declare function worldMuxOf(gateway: CarrierGatewayFace, options?: {
+export declare function worldMuxOf(gateway: CarrierGatewayFace, peer?: unknown, options?: {
     heartbeatIntervalMs?: number;
     failure?: (error: unknown) => MuxFailure;
 }): WorldMuxServer;

package/superd-hub/dist/carrier.js

@@ -177,7 +177,7 @@ export async function forwardApiCall(options, req, res) {
         }
         rpcId = envelope.rpcId;
         const controller = new AbortController();
-        const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal);
+        const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal, options.peer);
         // The gateway already returns a Result (`{ok:true,value}` | `{ok:false,error}`),
         // which is exactly the server-response's `result` field.
         writeJson(res, 200, serverResult(rpcId, result));
@@ -194,8 +194,8 @@ export async function forwardApiCall(options, req, res) {
     }
 }
 /** One WorldMuxServer bound to `gateway` — the canonical openWireStream wiring in one place. */
-export function worldMuxOf(gateway, options) {
-    return new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(gateway.openWireStream(endpoint, payload, uplink, undefined, control.signal, control)), {
+export function worldMuxOf(gateway, peer, options) {
+    return new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(gateway.openWireStream(endpoint, payload, uplink, peer, control.signal, control)), {
         ...(options?.heartbeatIntervalMs === undefined ? {} : { heartbeatIntervalMs: options.heartbeatIntervalMs }),
         ...(options?.failure === undefined ? {} : { failure: options.failure }),
     });

package/superd-hub/dist/client/pill-geometry.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Pill geometry for the Hub sidebar row's agent selector (2026-10-18): the
+ * pure math behind anchoring the selector to its row. Split out of
+ * HubPanelIcon so node tests can pin it from `dist/client/` — the
+ * mesh-groups precedent (pure logic beside the components, no DOM, no
+ * React, no @deepseek-ai imports).
+ *
+ * Why absolute-in-flow and not `position: fixed` + re-measure: the native
+ * sidebar scrolls (many workspaces; iOS Safari drags the whole page), and a
+ * fixed pill tracks the VIEWPORT, not the content — without a scroll
+ * listener it stayed at its mount-time viewport spot while the row moved
+ * (the reported mis-alignment). Anchoring the pill to its positioned
+ * ancestor (the `Menu` wrapper span — upstream `.root` is
+ * `position: relative`, in-flow inside the row) makes the composite ride ANY
+ * scroll natively: zero JS per scrolled frame, exact by construction, and
+ * the open menu keeps following through its own capture-phase scroll
+ * placement (`getAnchorRect` reads the pill live).
+ *
+ * @module superd-hub/client/pill-geometry
+ */
+/**
+ * The measured boxes one anchoring reads. All viewport px, straight from
+ * `getBoundingClientRect()` — same-frame reads, so any scroll moves both
+ * boxes equally and the derived offsets are scroll-invariant by
+ * construction.
+ */
+export interface PillMeasureInput {
+    /** The row button's box (the `.panelRow` the glyph sits in). */
+    row: {
+        readonly top: number;
+        readonly bottom: number;
+        readonly right: number;
+    };
+    /** The pill's positioned ancestor box (the `Menu` wrapper span). */
+    wrap: {
+        readonly left: number;
+        readonly top: number;
+    };
+}
+/** Wrapper-relative offsets the pill is placed from. */
+export interface PillBox {
+    /** Wrapper left edge → row right edge (px; both ride the same flow). */
+    readonly dx: number;
+    /** Wrapper top edge → row vertical center (px). */
+    readonly cy: number;
+}
+/**
+ * Derive the scroll-invariant offsets from one same-frame measurement.
+ * Measuring the DELTAS (not absolute coordinates) is the whole point: they
+ * survive any scroll of any ancestor, so nothing needs to re-run while the
+ * sidebar scrolls.
+ */
+export declare function measurePillBox(input: PillMeasureInput): PillBox;
+/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
+export declare const PILL_ROW_INSET = 8;
+/** Structural CSS style the render side spreads into the pill span. */
+export interface PillStyle {
+    readonly position: 'absolute';
+    readonly left: number;
+    readonly top: number;
+    readonly transform: string;
+}
+/**
+ * The pill's placement, wrapper-relative: its right edge sits `inset` px
+ * inside the row's right edge, vertically centered on the row
+ * (`translateY(-50%)`). `selectorWidth` is the render-time pill width (the
+ * mark is present only while an agent is active), so it stays a render
+ * concern; the measured box is not.
+ */
+export declare function pillStyle(box: PillBox, selectorWidth: number, inset?: number): PillStyle;

package/superd-hub/dist/client/pill-geometry.js

@@ -0,0 +1,49 @@
+/**
+ * Pill geometry for the Hub sidebar row's agent selector (2026-10-18): the
+ * pure math behind anchoring the selector to its row. Split out of
+ * HubPanelIcon so node tests can pin it from `dist/client/` — the
+ * mesh-groups precedent (pure logic beside the components, no DOM, no
+ * React, no @deepseek-ai imports).
+ *
+ * Why absolute-in-flow and not `position: fixed` + re-measure: the native
+ * sidebar scrolls (many workspaces; iOS Safari drags the whole page), and a
+ * fixed pill tracks the VIEWPORT, not the content — without a scroll
+ * listener it stayed at its mount-time viewport spot while the row moved
+ * (the reported mis-alignment). Anchoring the pill to its positioned
+ * ancestor (the `Menu` wrapper span — upstream `.root` is
+ * `position: relative`, in-flow inside the row) makes the composite ride ANY
+ * scroll natively: zero JS per scrolled frame, exact by construction, and
+ * the open menu keeps following through its own capture-phase scroll
+ * placement (`getAnchorRect` reads the pill live).
+ *
+ * @module superd-hub/client/pill-geometry
+ */
+/**
+ * Derive the scroll-invariant offsets from one same-frame measurement.
+ * Measuring the DELTAS (not absolute coordinates) is the whole point: they
+ * survive any scroll of any ancestor, so nothing needs to re-run while the
+ * sidebar scrolls.
+ */
+export function measurePillBox(input) {
+    return {
+        dx: input.row.right - input.wrap.left,
+        cy: (input.row.top + input.row.bottom) / 2 - input.wrap.top,
+    };
+}
+/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
+export const PILL_ROW_INSET = 8;
+/**
+ * The pill's placement, wrapper-relative: its right edge sits `inset` px
+ * inside the row's right edge, vertically centered on the row
+ * (`translateY(-50%)`). `selectorWidth` is the render-time pill width (the
+ * mark is present only while an agent is active), so it stays a render
+ * concern; the measured box is not.
+ */
+export function pillStyle(box, selectorWidth, inset = PILL_ROW_INSET) {
+    return {
+        position: 'absolute',
+        left: box.dx - inset - selectorWidth,
+        top: box.cy,
+        transform: 'translateY(-50%)',
+    };
+}

package/superd-hub/dist/client/switch.d.ts

@@ -107,6 +107,21 @@ export interface SwitchSessions {
 }
 /** Whether this page is a fusion page: the baked flag global is present. */
 export declare function fusionPage(): boolean;
+/**
+ * Live-install staleness probe (2026-10-18): the ONE call the client entry
+ * makes when the page does not carry the fusion flag. A flag-absent page is
+ * either a pre-install page (the client half hot-loaded into HTML served
+ * before the row mounted — the fresh-install case where the Hub row renders
+ * but every switch affordance stays hidden until a manual restart) or a
+ * deliberate flag-off deployment (T-E). The roster's additive `hub.fusion`
+ * answers which; on an armed host the page re-boots ONCE — the marker keeps
+ * a misbehaving host from ever looping the tab. Every failure mode (fetch
+ * error, non-OK, old host without the field) degrades to no action: the
+ * flag-off shapes below are the honest rendering of an unanswered probe.
+ *
+ * Fire-and-forget by contract — never throws, never blocks the apply.
+ */
+export declare function probeStaleFusionPage(): void;
 /** The page atom, when the page carries one (it always does on a fusion page). */
 export declare function uiState(): SuperdUiState | undefined;
 /**

package/superd-hub/dist/client/switch.js

@@ -37,7 +37,7 @@
  *
  * @module superd-hub/client/switch
  */
-import { createReadinessWaiter, createSwitchController, decidePreFlight, observeCachesRefreshed, runMachineDownFeedback, SESSIONS_CURRENT_KEY, } from '../switch-core.js';
+import { createReadinessWaiter, createSwitchController, decidePreFlight, observeCachesRefreshed, runMachineDownFeedback, SESSIONS_CURRENT_KEY, FUSION_RELOAD_MARKER, fusionReloadDecision, } from '../switch-core.js';
 import { showSuperdToast } from '../toast-core.js';
 import { fetchMachines, reprobeMachine } from './mesh-api.js';
 import { fetchRoster } from './roster.js';
@@ -45,6 +45,59 @@ import { fetchRoster } from './roster.js';
 export function fusionPage() {
     return globalThis.__SUPERD_UI_FUSION__ === true;
 }
+/**
+ * The sessionStorage marker read (undefined-safe: a storage failure is
+ * `false` — the probe then reloads without the loop guard, which only
+ * matters for a host that reports fusion but never bakes the flag).
+ */
+function staleReloadMarker() {
+    try {
+        const storage = globalThis.sessionStorage;
+        return storage?.getItem(FUSION_RELOAD_MARKER) !== null;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Live-install staleness probe (2026-10-18): the ONE call the client entry
+ * makes when the page does not carry the fusion flag. A flag-absent page is
+ * either a pre-install page (the client half hot-loaded into HTML served
+ * before the row mounted — the fresh-install case where the Hub row renders
+ * but every switch affordance stays hidden until a manual restart) or a
+ * deliberate flag-off deployment (T-E). The roster's additive `hub.fusion`
+ * answers which; on an armed host the page re-boots ONCE — the marker keeps
+ * a misbehaving host from ever looping the tab. Every failure mode (fetch
+ * error, non-OK, old host without the field) degrades to no action: the
+ * flag-off shapes below are the honest rendering of an unanswered probe.
+ *
+ * Fire-and-forget by contract — never throws, never blocks the apply.
+ */
+export function probeStaleFusionPage() {
+    void (async () => {
+        let hubFusion;
+        try {
+            const response = await fetch('/api/agent-runtime', { credentials: 'same-origin' });
+            if (!response.ok)
+                return;
+            hubFusion = (await response.json()).hub?.fusion;
+        }
+        catch {
+            return;
+        }
+        if (fusionReloadDecision({ flagPresent: fusionPage(), markerPresent: staleReloadMarker(), hubFusion }) !== 'reload')
+            return;
+        try {
+            ;
+            globalThis.sessionStorage?.setItem(FUSION_RELOAD_MARKER, '1');
+        }
+        catch {
+            /* private-mode storage: reload without the marker (a truthful host re-arms the page, ending the flow) */
+        }
+        ;
+        globalThis.location?.reload();
+    })();
+}
 /** The page atom, when the page carries one (it always does on a fusion page). */
 export function uiState() {
     const state = globalThis.__SUPERD_UI_STATE__;

package/superd-hub/dist/companions.js

@@ -3,8 +3,9 @@ import { createHash } from 'node:crypto';
 import { readFile, mkdir, unlink, rmdir } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
-// done marks a CONFIRMED first use (Better observed installed). A receipt with attempted
-// but neither done nor error is an interrupted first use — e.g. killed by the restart
+// done marks a CONFIRMED first use (Better observed installed); removed marks a
+// migrated legacy removal record. A receipt with attempted but neither done,
+// error, nor removed is an interrupted first use — e.g. killed by the restart
 // that installing Super itself triggers — and must re-arm, not suppress, the retry.
 const message = (error) => error instanceof Error ? error.message : String(error);
 async function optionalJson(path) {
@@ -48,9 +49,10 @@ export class BetterDashCompanion {
         return this.initialized ??= (async () => {
             const saved = await optionalJson(this.receipt);
             if (saved !== undefined) {
-                // Never-resurrect applies only to a CONFIRMED first use or a recorded
-                // failure; an interrupted first use (no done, no error) re-arms.
-                this.intent = saved.attempted && saved.done !== true && saved.error === undefined
+                // Never-resurrect applies to a CONFIRMED first use, a recorded failure,
+                // or a migrated removal record; an interrupted first use (no done, no
+                // error, no removal marker) re-arms.
+                this.intent = saved.attempted && saved.done !== true && saved.error === undefined && saved.removed !== true
                     ? { attempted: false } : saved;
                 await this.cleanLegacy();
                 return;
@@ -59,7 +61,7 @@ export class BetterDashCompanion {
             // Any old registration was first use. An absent Better now means removal,
             // including when Super has since changed version; never resurrect it.
             if (old?.['super-dsh:better-dsh'] !== undefined) {
-                this.intent = { attempted: true };
+                this.intent = { attempted: true, removed: true };
                 await this.save();
                 await this.cleanLegacy();
             }

package/superd-hub/dist/fusion-transport.d.ts

@@ -117,6 +117,13 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 }>>, Schemastery.ObjectT<NoInfer<{
     enabled: z<boolean, boolean, "defined">;
 }>>, "plain">;
+/**
+ * Whether the fusion row currently injects the transport script + flag
+ * global into served indexes. `false` before the first mount and after
+ * disposal — the roster GET answers with exactly this, and a stale page's
+ * client half reloads on `true` only (switch-core's `fusionReloadDecision`).
+ */
+export declare function fusionTransportArmed(): boolean;
 /** Cordis plugin name. */
 export declare const name = "superd-fusion-transport";
 /**
@@ -132,8 +139,18 @@ export declare const inject: string[];
  * the {@link FUSION_FLAG_GLOBAL} baked global row (Task 4): one gate, both
  * halves.
  *
+ * Armed state: while the listener is registered the row publishes
+ * {@link fusionTransportArmed} = true (counter-owned, reset on effect
+ * disposal) — the one fact an already-open page needs to know that its
+ * stale, pre-install HTML cannot tell it. Consumed additively as
+ * `hub.fusion` on the roster GET (rpc.ts).
  * Off → the component registers nothing: no listener, no row, no script,
- * no flag global.
+ * no flag global. When ON, the row also publishes its armed state through
+ * {@link fusionTransportArmed}, which the roster RPC's additive `hub.fusion`
+ * field carries to already-open pages: their client half probes it and
+ * re-boots the page once (see switch-core's live-install staleness block —
+ * the served index predates the install, so only a re-serve can bake the
+ * flag + transport script).
  * @param ctx - host plugin context.
  * @param config - the row config (`enabled`, default on).
  */

package/superd-hub/dist/fusion-transport.js

@@ -356,6 +356,25 @@ export const FUSION_FLAG_GLOBAL = '__SUPERD_UI_FUSION__';
 export const Config = z.object({
     enabled: z.boolean().default(true),
 });
+/**
+ * How many live index-inject listeners this row has registered (one per
+ * mounted component fiber). Module-level because the consumer (the roster
+ * RPC) is a DIFFERENT row in the same bundle: a cross-row import of live
+ * composition state, the same single-instance guarantee that lets the
+ * client half share the shell's module table. Reset by the listener
+ * effect's disposal, so a runtime row disable stops the advertisement
+ * immediately.
+ */
+let armedRows = 0;
+/**
+ * Whether the fusion row currently injects the transport script + flag
+ * global into served indexes. `false` before the first mount and after
+ * disposal — the roster GET answers with exactly this, and a stale page's
+ * client half reloads on `true` only (switch-core's `fusionReloadDecision`).
+ */
+export function fusionTransportArmed() {
+    return armedRows > 0;
+}
 /** Cordis plugin name. */
 export const name = 'superd-fusion-transport';
 /**
@@ -371,8 +390,18 @@ export const inject = [];
  * the {@link FUSION_FLAG_GLOBAL} baked global row (Task 4): one gate, both
  * halves.
  *
+ * Armed state: while the listener is registered the row publishes
+ * {@link fusionTransportArmed} = true (counter-owned, reset on effect
+ * disposal) — the one fact an already-open page needs to know that its
+ * stale, pre-install HTML cannot tell it. Consumed additively as
+ * `hub.fusion` on the roster GET (rpc.ts).
  * Off → the component registers nothing: no listener, no row, no script,
- * no flag global.
+ * no flag global. When ON, the row also publishes its armed state through
+ * {@link fusionTransportArmed}, which the roster RPC's additive `hub.fusion`
+ * field carries to already-open pages: their client half probes it and
+ * re-boots the page once (see switch-core's live-install staleness block —
+ * the served index predates the install, so only a re-serve can bake the
+ * flag + transport script).
  * @param ctx - host plugin context.
  * @param config - the row config (`enabled`, default on).
  */
@@ -382,10 +411,20 @@ export function apply(ctx, config) {
     if (config?.enabled === false)
         return;
     ctx.inject(['webServer'], () => {
-        ctx.on('webserver/index-inject', (table) => {
-            table.push({ kind: 'script', placement: 'head', text: renderFusionTransport() });
-            table.push({ kind: 'global', name: FUSION_FLAG_GLOBAL, value: true });
-        });
+        // The armed state rides the LISTENER's lifetime (an effect, not a bare
+        // mount): a live row disable/unload resets it, so the roster answer can
+        // never advertise fusion for a row that no longer injects anything.
+        ctx.effect(() => {
+            armedRows += 1;
+            const offInject = ctx.on('webserver/index-inject', (table) => {
+                table.push({ kind: 'script', placement: 'head', text: renderFusionTransport() });
+                table.push({ kind: 'global', name: FUSION_FLAG_GLOBAL, value: true });
+            });
+            return () => {
+                armedRows -= 1;
+                offInject();
+            };
+        }, 'superd-fusion-transport: index injection (armed state)');
     });
 }
 export default { name, inject, Config, apply };

package/superd-hub/dist/gateway.js

@@ -90,7 +90,14 @@ export function apply(ctx, config) {
             real: real,
             authorize: (req, res) => connection.authorizeIndex(req, res),
             requestRejection: (req) => connection.requestRejection(req),
-            gatewayOf: (label) => (federatedGatewayOf(label) ?? getTarget(label)?.gateway),
+            gatewayOf: (label) => {
+                const federated = federatedGatewayOf(label);
+                if (federated !== undefined)
+                    return { key: label, gateway: federated };
+                // The stored face IS the service instance (canonical methods); targets.ts
+                // keeps a looser structural view for the mesh wire adapters.
+                return getTarget(label);
+            },
         }), 'superd-hub: /hub route family');
         // P4 §8.2: the PTY executor's upgrade route — same gate as the /hub family
         // (authorizeIndex cookie auth first, then the browser-trust fence). The

package/superd-hub/dist/hub-route.d.ts

@@ -63,8 +63,11 @@ export interface HubRouteOptions {
      * answer, so even the demux 404s never speak to untrusted traffic.
      */
     requestRejection?(req: unknown): number | undefined;
-    /** The live gateway of a registered label, or undefined (unknown / not yet spawned). */
-    gatewayOf(label: string): CarrierGatewayFace | undefined;
+    /** The live target (gateway + owner peer) of a registered label, or undefined (unknown / not yet spawned). */
+    gatewayOf(label: string): {
+        gateway: CarrierGatewayFace;
+        peer?: unknown;
+    } | undefined;
 }
 /**
  * Register the family on ctx0's webServer.

package/superd-hub/dist/hub-route.js

@@ -130,15 +130,15 @@ export function registerHubRoute(options) {
             });
             return;
         }
-        const gateway = options.gatewayOf(agent);
-        if (gateway === undefined) {
+        const target = options.gatewayOf(agent);
+        if (target === undefined) {
             answer404(res, { error: 'unknown-agent', label: agent });
             return;
         }
         // Consume the family plumbing: the kernel forwards a native-shaped URL
         // (the kernel carries the same fence face as the carrier's own kernel).
         req.url = worldUrlOf(req.url);
-        await forwardApiCall({ gateway, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
+        await forwardApiCall({ gateway: target.gateway, peer: target.peer, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
     };
     const handleUpgrade = (req, socket, head) => {
         if (!gateUpgrade(options, req, socket))
@@ -155,8 +155,8 @@ export function registerHubRoute(options) {
             rejectUpgrade(socket, 404, JSON.stringify({ error: 'foreign-only' }), 'application/json');
             return;
         }
-        const gateway = options.gatewayOf(agent);
-        if (gateway === undefined) {
+        const target = options.gatewayOf(agent);
+        if (target === undefined) {
             rejectUpgrade(socket, 404, JSON.stringify({ error: 'unknown-agent', label: agent }), 'application/json');
             return;
         }
@@ -165,7 +165,7 @@ export function registerHubRoute(options) {
         // a heartbeat interval and a per-connection WebSocketServer; on socket
         // close it must be CLOSED (world-mux clears the heartbeat only in close),
         // or every reconnect leaks the timer plus the mux graph forever.
-        const mux = worldMuxOf(gateway);
+        const mux = worldMuxOf(target.gateway, target.peer);
         socket.once?.('close', () => {
             void mux.close().catch(() => undefined);
         });

package/superd-hub/dist/rpc.d.ts

@@ -37,6 +37,11 @@ export interface AgentRuntimeDeps {
  * ADDITIVE contract (mesh P1): the GET body gained `hub: {machineId, label,
  * version}` and every `agents` row gained `id` (a6); `available` and all
  * pre-existing agents fields are unchanged — old clients ignore the new
+ * fields, new clients read them. Live-install staleness (2026-10-18): the
+ * hub block also carries `fusion` — the fusion row's armed state — so a
+ * page that booted before super-dsh was installed can tell its own
+ * staleness apart from a flag-off deployment and reload once (switch-core
+ * `fusionReloadDecision`).
  * fields, new clients read them.
  * @param request - the incoming `/api/agent-runtime` request.
  * @param source - live runtime registry view.

package/superd-hub/dist/rpc.js

@@ -3,6 +3,7 @@ import { PACK_VERSION } from './pack-version.js';
 import { listRuntimeKeys } from './targets.js';
 import { agentLinks } from './agent-roster.js';
 import { ensureSelf } from './machines.js';
+import { fusionTransportArmed } from './fusion-transport.js';
 /** The shared-channel Fetch route path this RPC face owns. */
 export const AGENT_RUNTIME_RPC_PATH = '/api/agent-runtime';
 /** The live registry view: native plus every registered foreign context. */
@@ -27,6 +28,11 @@ function json(status, body) {
  * ADDITIVE contract (mesh P1): the GET body gained `hub: {machineId, label,
  * version}` and every `agents` row gained `id` (a6); `available` and all
  * pre-existing agents fields are unchanged — old clients ignore the new
+ * fields, new clients read them. Live-install staleness (2026-10-18): the
+ * hub block also carries `fusion` — the fusion row's armed state — so a
+ * page that booted before super-dsh was installed can tell its own
+ * staleness apart from a flag-off deployment and reload once (switch-core
+ * `fusionReloadDecision`).
  * fields, new clients read them.
  * @param request - the incoming `/api/agent-runtime` request.
  * @param source - live runtime registry view.
@@ -51,7 +57,20 @@ export async function handleAgentRuntime(request, source, deps) {
         const links = new URL(request.url).searchParams.get('mesh') === '1'
             ? agentLinks(home).filter((l) => l.machine === 'local')
             : agentLinks(home);
-        return json(200, { available, agents: links, hub: { machineId: self.id, label: self.label, version: HUB_VERSION } });
+        return json(200, {
+            available,
+            agents: links,
+            hub: {
+                machineId: self.id,
+                label: self.label,
+                version: HUB_VERSION,
+                // Additive (live-install staleness): `true` exactly while the fusion
+                // row is armed — the fact a pre-install page cannot read off its own
+                // HTML. Peers' `?mesh=1` probes ignore it (same additivity rule as
+                // every hub-block field before it).
+                fusion: fusionTransportArmed(),
+            },
+        });
     }
     // A POST that used to switch a global selector has no meaning any more:
     // the addressed world is the mount path of the request, not a shared value.

package/superd-hub/dist/switch-core.d.ts

@@ -9,6 +9,16 @@
  * roster-probe failure → revert to native + a visible toast, never a page
  * lock).
  *
+ * Live-install staleness (2026-10-18): the fusion flag global and the
+ * transport script are baked into the SERVED index, so a page that booted
+ * before super-dsh was installed runs the freshly hot-loaded client half
+ * against a stale page — `fusionPage()` reads false and every switch
+ * affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+ * is the pure decision behind the client half's heal: one roster answer later,
+ * reload the page once. The transport must precede app boot (its upload hook
+ * `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+ * can never arm a stale page honestly — the page must be re-served.
+ *
  * Host-half on purpose: plain TS with every effect injected through
  * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
  * imports it from `dist/` like every other host module. The client half
@@ -445,6 +455,37 @@ export interface SwitchAffordance {
  * Host-half pure logic so `test/client-switch.test.mjs` pins it from `dist/`.
  */
 export declare function switchAffordance(fusion: boolean): SwitchAffordance;
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+export declare const FUSION_RELOAD_MARKER = "superd.fusion-armed.reload";
+/** What the stale-page probe decides (the client binding executes it). */
+export type FusionReloadDecision = 
+/** Flag present — the page is armed; nothing to heal. */
+'armed'
+/** The marker is set — this tab already reloaded once; never loop. */
+ | 'already-reloaded'
+/** The host answered `hub.fusion: false` — the T-E flag-off shape; stay degraded. */
+ | 'row-off'
+/** No usable answer (old host without the additive field, or the fetch failed) — stay degraded. */
+ | 'host-silent'
+/** Stale page + an armed host — set the marker and reload once. */
+ | 'reload';
+/** The inputs of one stale-page probe decision. */
+export interface FusionReloadInput {
+    /** Whether the page carries the baked `__SUPERD_UI_FUSION__` flag global. */
+    flagPresent: boolean;
+    /** Whether {@link FUSION_RELOAD_MARKER} is already in sessionStorage. */
+    markerPresent: boolean;
+    /** The roster answer's additive `hub.fusion` field (undefined: absent). */
+    hubFusion?: unknown;
+}
+/**
+ * The live-install staleness decision (host-half pure so the node tests pin
+ * the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+ * that distinguishes a page-booted-before-install from a deliberately
+ * flag-off deployment — without it the reload would loop forever on every
+ * `enabled: false` composition (the client half loads there too).
+ */
+export declare function fusionReloadDecision(input: FusionReloadInput): FusionReloadDecision;
 /**
  * Structural slice of one roster row the Hub UI helpers read (the client
  * roster's `AgentLink` shape mirrored structurally — this module never imports

package/superd-hub/dist/switch-core.js

@@ -9,6 +9,16 @@
  * roster-probe failure → revert to native + a visible toast, never a page
  * lock).
  *
+ * Live-install staleness (2026-10-18): the fusion flag global and the
+ * transport script are baked into the SERVED index, so a page that booted
+ * before super-dsh was installed runs the freshly hot-loaded client half
+ * against a stale page — `fusionPage()` reads false and every switch
+ * affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+ * is the pure decision behind the client half's heal: one roster answer later,
+ * reload the page once. The transport must precede app boot (its upload hook
+ * `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+ * can never arm a stale page honestly — the page must be re-served.
+ *
  * Host-half on purpose: plain TS with every effect injected through
  * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
  * imports it from `dist/` like every other host module. The client half
@@ -488,6 +498,36 @@ export const FUSION_OFF_HINT = 'fusion off — no foreign entry';
 export function switchAffordance(fusion) {
     return fusion ? { available: true, hint: '' } : { available: false, hint: FUSION_OFF_HINT };
 }
+// ---- Live-install staleness: the once-per-session reload heal -------------
+//
+// The flag global is `webserver/index-inject` state: a page served BEFORE
+// the fusion row mounted never carries it, while the client graph hot-update
+// (dsh-client-hmr) still applies the client half to that page — the Hub row
+// appears, the selector does not, and only a manual restart healed it. The
+// heal re-boots the page ONCE (a sessionStorage marker keeps a host that
+// reports fusion but never bakes the flag from looping the tab), because the
+// transport script is boot-time by design: a stale page cannot be armed in
+// place, only re-served.
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+export const FUSION_RELOAD_MARKER = 'superd.fusion-armed.reload';
+/**
+ * The live-install staleness decision (host-half pure so the node tests pin
+ * the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+ * that distinguishes a page-booted-before-install from a deliberately
+ * flag-off deployment — without it the reload would loop forever on every
+ * `enabled: false` composition (the client half loads there too).
+ */
+export function fusionReloadDecision(input) {
+    if (input.flagPresent)
+        return 'armed';
+    if (input.markerPresent)
+        return 'already-reloaded';
+    if (input.hubFusion === true)
+        return 'reload';
+    if (input.hubFusion === false)
+        return 'row-off';
+    return 'host-silent';
+}
 /**
  * The active agent's display name for the Hub row's right-edge selector: the
  * roster label of the atom's `activeAgent` key — the name the selector's

package/superd-hub/dist/targets.d.ts

@@ -22,6 +22,13 @@ export interface ForeignTarget {
     key: string;
     /** The context's typertGateway service instance (or a wire adapter with the same face). */
     gateway: GatewayFace;
+    /**
+     * The world's owner browser Peer (connection.browserPeer) for in-process
+     * faces — DSH 0.2.1 gateways read peer.signal/principal on every forwarded
+     * invocation, so the hub must present the world's shared owner identity.
+     * Wire adapters (mesh federation) omit it: the far end supplies its own.
+     */
+    peer?: unknown;
 }
 /** Register (or replace) the target for a runtime key. */
 export declare function registerForeignTarget(target: ForeignTarget): void;

package/superd-hub/dist/world-lifecycle.js

@@ -48,7 +48,7 @@ export function ownWorld(ctx, entry, spawn, onFailure) {
                     unregisterForeignTarget(key);
                 setReady(key, false);
             }, `superd.world.${key}: availability`);
-            target = { key, gateway: world.get('typertGateway') };
+            target = { key, gateway: world.get('typertGateway'), peer: world.get('connection')?.browserPeer };
             registerForeignTarget(target);
             setReady(key, true);
             return world;

package/superd-hub/lib/client/index.js

@@ -898,6 +898,16 @@ function machineLabelsFrom(list) {
 * roster-probe failure → revert to native + a visible toast, never a page
 * lock).
 *
+* Live-install staleness (2026-10-18): the fusion flag global and the
+* transport script are baked into the SERVED index, so a page that booted
+* before super-dsh was installed runs the freshly hot-loaded client half
+* against a stale page — `fusionPage()` reads false and every switch
+* affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+* is the pure decision behind the client half's heal: one roster answer later,
+* reload the page once. The transport must precede app boot (its upload hook
+* `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+* can never arm a stale page honestly — the page must be re-served.
+*
 * Host-half on purpose: plain TS with every effect injected through
 * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
 * imports it from `dist/` like every other host module. The client half
@@ -1343,6 +1353,22 @@ function switchAffordance(fusion) {
 		hint: FUSION_OFF_HINT
 	};
 }
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+const FUSION_RELOAD_MARKER = "superd.fusion-armed.reload";
+/**
+* The live-install staleness decision (host-half pure so the node tests pin
+* the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+* that distinguishes a page-booted-before-install from a deliberately
+* flag-off deployment — without it the reload would loop forever on every
+* `enabled: false` composition (the client half loads there too).
+*/
+function fusionReloadDecision(input) {
+	if (input.flagPresent) return "armed";
+	if (input.markerPresent) return "already-reloaded";
+	if (input.hubFusion === true) return "reload";
+	if (input.hubFusion === false) return "row-off";
+	return "host-silent";
+}
 /**
 * The active agent's display name for the Hub row's right-edge selector: the
 * roster label of the atom's `activeAgent` key — the name the selector's
@@ -1621,6 +1647,53 @@ function createReadinessWaiter(faces, options = {}) {
 function fusionPage() {
 	return globalThis.__SUPERD_UI_FUSION__ === true;
 }
+/**
+* The sessionStorage marker read (undefined-safe: a storage failure is
+* `false` — the probe then reloads without the loop guard, which only
+* matters for a host that reports fusion but never bakes the flag).
+*/
+function staleReloadMarker() {
+	try {
+		return globalThis.sessionStorage?.getItem(FUSION_RELOAD_MARKER) !== null;
+	} catch {
+		return false;
+	}
+}
+/**
+* Live-install staleness probe (2026-10-18): the ONE call the client entry
+* makes when the page does not carry the fusion flag. A flag-absent page is
+* either a pre-install page (the client half hot-loaded into HTML served
+* before the row mounted — the fresh-install case where the Hub row renders
+* but every switch affordance stays hidden until a manual restart) or a
+* deliberate flag-off deployment (T-E). The roster's additive `hub.fusion`
+* answers which; on an armed host the page re-boots ONCE — the marker keeps
+* a misbehaving host from ever looping the tab. Every failure mode (fetch
+* error, non-OK, old host without the field) degrades to no action: the
+* flag-off shapes below are the honest rendering of an unanswered probe.
+*
+* Fire-and-forget by contract — never throws, never blocks the apply.
+*/
+function probeStaleFusionPage() {
+	(async () => {
+		let hubFusion;
+		try {
+			const response = await fetch("/api/agent-runtime", { credentials: "same-origin" });
+			if (!response.ok) return;
+			hubFusion = (await response.json()).hub?.fusion;
+		} catch {
+			return;
+		}
+		if (fusionReloadDecision({
+			flagPresent: fusionPage(),
+			markerPresent: staleReloadMarker(),
+			hubFusion
+		}) !== "reload") return;
+		try {
+			globalThis.sessionStorage?.setItem(FUSION_RELOAD_MARKER, "1");
+		} catch {}
+		globalThis.location?.reload();
+	})();
+}
 /** The page atom, when the page carries one (it always does on a fusion page). */
 function uiState() {
 	const state = globalThis.__SUPERD_UI_STATE__;
@@ -3880,6 +3953,38 @@ function HubPage() {
 	});
 }
 
+//#endregion
+//#region src/client/pill-geometry.ts
+/**
+* Derive the scroll-invariant offsets from one same-frame measurement.
+* Measuring the DELTAS (not absolute coordinates) is the whole point: they
+* survive any scroll of any ancestor, so nothing needs to re-run while the
+* sidebar scrolls.
+*/
+function measurePillBox(input) {
+	return {
+		dx: input.row.right - input.wrap.left,
+		cy: (input.row.top + input.row.bottom) / 2 - input.wrap.top
+	};
+}
+/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
+const PILL_ROW_INSET = 8;
+/**
+* The pill's placement, wrapper-relative: its right edge sits `inset` px
+* inside the row's right edge, vertically centered on the row
+* (`translateY(-50%)`). `selectorWidth` is the render-time pill width (the
+* mark is present only while an agent is active), so it stays a render
+* concern; the measured box is not.
+*/
+function pillStyle(box, selectorWidth, inset = PILL_ROW_INSET) {
+	return {
+		position: "absolute",
+		left: box.dx - inset - selectorWidth,
+		top: box.cy,
+		transform: "translateY(-50%)"
+	};
+}
+
 //#endregion
 //#region src/client/HubPanelIcon.tsx
 /** Runtime-mark edge inside the selector, and the chevron's own default edge. */
@@ -3893,8 +3998,6 @@ const CHEVRON_SIZE = 14;
 const SELECTOR_HEIGHT = 28;
 const SELECTOR_PAD = 8;
 const SELECTOR_GAP = 4;
-/** The row's own horizontal padding (native `.panelRow`): the selector's inset. */
-const ROW_INSET = 8;
 function HubPanelIcon({ size }) {
 	const wide = size <= 16;
 	const rootRef = react.useRef(null);
@@ -3917,16 +4020,25 @@ function HubPanelIcon({ size }) {
 	}, [fusion]);
 	const measure = react.useCallback(() => {
 		const row = rootRef.current?.closest("button") ?? null;
-		if (row === null) {
+		const wrap = selectorRef.current?.parentElement ?? null;
+		if (row === null || wrap === null) {
 			setBox(null);
 			return;
 		}
-		const rect = row.getBoundingClientRect();
-		setBox((prev) => prev !== null && prev.top === rect.top && prev.bottom === rect.bottom && prev.right === rect.right ? prev : {
-			top: rect.top,
-			bottom: rect.bottom,
-			right: rect.right
+		const rowRect = row.getBoundingClientRect();
+		const wrapRect = wrap.getBoundingClientRect();
+		const next = measurePillBox({
+			row: {
+				top: rowRect.top,
+				bottom: rowRect.bottom,
+				right: rowRect.right
+			},
+			wrap: {
+				left: wrapRect.left,
+				top: wrapRect.top
+			}
 		});
+		setBox((prev) => prev !== null && prev.dx === next.dx && prev.cy === next.cy ? prev : next);
 	}, []);
 	react.useLayoutEffect(() => {
 		if (!wide || !switchUi.available) return;
@@ -4036,7 +4148,7 @@ function HubPanelIcon({ size }) {
 		children: [
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(HubGlyph, { size }),
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SuperdToastHost, {}),
-			wide && box !== null && switchUi.available && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__deepseek_ai_dsh_client_ui_primitives.Menu, {
+			wide && switchUi.available && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(__deepseek_ai_dsh_client_ui_primitives.Menu, {
 				open,
 				onClose: () => {
 					setOpen(false);
@@ -4057,10 +4169,11 @@ function HubPanelIcon({ size }) {
 					"aria-expanded": open,
 					title: activeLabel === void 0 ? "Agent selector" : `Agent selector: ${activeLabel}`,
 					style: {
-						position: "fixed",
-						left: box.right - ROW_INSET - selectorWidth,
-						top: box.top + (box.bottom - box.top) / 2,
-						transform: "translateY(-50%)",
+						...pillStyle(box ?? {
+							dx: 0,
+							cy: 0
+						}, selectorWidth),
+						visibility: box === null ? "hidden" : "visible",
 						display: "inline-flex",
 						alignItems: "center",
 						justifyContent: "center",
@@ -4105,9 +4218,17 @@ const inject = ["slots"];
 * absent (a composition without the sidebar renders nothing — every seat
 * here is an optional occupant by contract).
 *
-* @param ctx - client root context.
+* Live-install staleness: the fusion flag is baked into the SERVED index, so
+* a page that booted before super-dsh was installed carries no flag even
+* though this very apply is the hot-loaded client half — the Hub row would
+* render with every switch affordance hidden until a manual restart. When
+* the flag is absent the entry probes the roster's `hub.fusion` once and
+* re-boots the page on an armed host (switch.ts `probeStaleFusionPage`; the
+* sessionStorage marker bounds it to one reload per tab session). A flag-off
+* deployment answers `false` and keeps the T-E inert shape with no reload.
 */
 function apply(ctx) {
+	if (!fusionPage()) probeStaleFusionPage();
 	ctx.inject(["slots"], (raw) => {
 		const scope = raw;
 		scope.effect(() => scope.slots.inject("main", () => scope.slots.register({