super-dsh 0.3.1 → 0.3.2-e

package/superd-hub/dist/fusion-transport.js

@@ -356,6 +356,25 @@ export const FUSION_FLAG_GLOBAL = '__SUPERD_UI_FUSION__';
 export const Config = z.object({
     enabled: z.boolean().default(true),
 });
+/**
+ * How many live index-inject listeners this row has registered (one per
+ * mounted component fiber). Module-level because the consumer (the roster
+ * RPC) is a DIFFERENT row in the same bundle: a cross-row import of live
+ * composition state, the same single-instance guarantee that lets the
+ * client half share the shell's module table. Reset by the listener
+ * effect's disposal, so a runtime row disable stops the advertisement
+ * immediately.
+ */
+let armedRows = 0;
+/**
+ * Whether the fusion row currently injects the transport script + flag
+ * global into served indexes. `false` before the first mount and after
+ * disposal — the roster GET answers with exactly this, and a stale page's
+ * client half reloads on `true` only (switch-core's `fusionReloadDecision`).
+ */
+export function fusionTransportArmed() {
+    return armedRows > 0;
+}
 /** Cordis plugin name. */
 export const name = 'superd-fusion-transport';
 /**
@@ -371,8 +390,18 @@ export const inject = [];
  * the {@link FUSION_FLAG_GLOBAL} baked global row (Task 4): one gate, both
  * halves.
  *
+ * Armed state: while the listener is registered the row publishes
+ * {@link fusionTransportArmed} = true (counter-owned, reset on effect
+ * disposal) — the one fact an already-open page needs to know that its
+ * stale, pre-install HTML cannot tell it. Consumed additively as
+ * `hub.fusion` on the roster GET (rpc.ts).
  * Off → the component registers nothing: no listener, no row, no script,
- * no flag global.
+ * no flag global. When ON, the row also publishes its armed state through
+ * {@link fusionTransportArmed}, which the roster RPC's additive `hub.fusion`
+ * field carries to already-open pages: their client half probes it and
+ * re-boots the page once (see switch-core's live-install staleness block —
+ * the served index predates the install, so only a re-serve can bake the
+ * flag + transport script).
  * @param ctx - host plugin context.
  * @param config - the row config (`enabled`, default on).
  */
@@ -382,10 +411,20 @@ export function apply(ctx, config) {
     if (config?.enabled === false)
         return;
     ctx.inject(['webServer'], () => {
-        ctx.on('webserver/index-inject', (table) => {
-            table.push({ kind: 'script', placement: 'head', text: renderFusionTransport() });
-            table.push({ kind: 'global', name: FUSION_FLAG_GLOBAL, value: true });
-        });
+        // The armed state rides the LISTENER's lifetime (an effect, not a bare
+        // mount): a live row disable/unload resets it, so the roster answer can
+        // never advertise fusion for a row that no longer injects anything.
+        ctx.effect(() => {
+            armedRows += 1;
+            const offInject = ctx.on('webserver/index-inject', (table) => {
+                table.push({ kind: 'script', placement: 'head', text: renderFusionTransport() });
+                table.push({ kind: 'global', name: FUSION_FLAG_GLOBAL, value: true });
+            });
+            return () => {
+                armedRows -= 1;
+                offInject();
+            };
+        }, 'superd-fusion-transport: index injection (armed state)');
     });
 }
 export default { name, inject, Config, apply };

package/superd-hub/dist/gateway.js

@@ -90,7 +90,14 @@ export function apply(ctx, config) {
             real: real,
             authorize: (req, res) => connection.authorizeIndex(req, res),
             requestRejection: (req) => connection.requestRejection(req),
-            gatewayOf: (label) => (federatedGatewayOf(label) ?? getTarget(label)?.gateway),
+            gatewayOf: (label) => {
+                const federated = federatedGatewayOf(label);
+                if (federated !== undefined)
+                    return { key: label, gateway: federated };
+                // The stored face IS the service instance (canonical methods); targets.ts
+                // keeps a looser structural view for the mesh wire adapters.
+                return getTarget(label);
+            },
         }), 'superd-hub: /hub route family');
         // P4 §8.2: the PTY executor's upgrade route — same gate as the /hub family
         // (authorizeIndex cookie auth first, then the browser-trust fence). The

package/superd-hub/dist/hub-route.d.ts

@@ -63,8 +63,11 @@ export interface HubRouteOptions {
      * answer, so even the demux 404s never speak to untrusted traffic.
      */
     requestRejection?(req: unknown): number | undefined;
-    /** The live gateway of a registered label, or undefined (unknown / not yet spawned). */
-    gatewayOf(label: string): CarrierGatewayFace | undefined;
+    /** The live target (gateway + owner peer) of a registered label, or undefined (unknown / not yet spawned). */
+    gatewayOf(label: string): {
+        gateway: CarrierGatewayFace;
+        peer?: unknown;
+    } | undefined;
 }
 /**
  * Register the family on ctx0's webServer.

package/superd-hub/dist/hub-route.js

@@ -130,15 +130,15 @@ export function registerHubRoute(options) {
             });
             return;
         }
-        const gateway = options.gatewayOf(agent);
-        if (gateway === undefined) {
+        const target = options.gatewayOf(agent);
+        if (target === undefined) {
             answer404(res, { error: 'unknown-agent', label: agent });
             return;
         }
         // Consume the family plumbing: the kernel forwards a native-shaped URL
         // (the kernel carries the same fence face as the carrier's own kernel).
         req.url = worldUrlOf(req.url);
-        await forwardApiCall({ gateway, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
+        await forwardApiCall({ gateway: target.gateway, peer: target.peer, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
     };
     const handleUpgrade = (req, socket, head) => {
         if (!gateUpgrade(options, req, socket))
@@ -155,8 +155,8 @@ export function registerHubRoute(options) {
             rejectUpgrade(socket, 404, JSON.stringify({ error: 'foreign-only' }), 'application/json');
             return;
         }
-        const gateway = options.gatewayOf(agent);
-        if (gateway === undefined) {
+        const target = options.gatewayOf(agent);
+        if (target === undefined) {
             rejectUpgrade(socket, 404, JSON.stringify({ error: 'unknown-agent', label: agent }), 'application/json');
             return;
         }
@@ -165,7 +165,7 @@ export function registerHubRoute(options) {
         // a heartbeat interval and a per-connection WebSocketServer; on socket
         // close it must be CLOSED (world-mux clears the heartbeat only in close),
         // or every reconnect leaks the timer plus the mux graph forever.
-        const mux = worldMuxOf(gateway);
+        const mux = worldMuxOf(target.gateway, target.peer);
         socket.once?.('close', () => {
             void mux.close().catch(() => undefined);
         });

package/superd-hub/dist/hub-tool.d.ts

@@ -19,7 +19,7 @@ export interface HubToolExecFace {
     pty(sessionKey: string, machine: string, cmd: string, opts?: {
         timeoutSec?: number;
         stdin?: string;
-    }): Promise<import('./exec-pty-session.js').PtyDispatchResult>;
+    }): Promise<import('../../remote/plugin.js').PtyDispatchResult>;
 }
 import type { A2aAddress, A2aInitiator, A2aService } from './a2a-service.js';
 /** The service face the tool consumes (structural subset of T2/T3's A2aService). */

package/superd-hub/dist/hub-tool.js

@@ -36,8 +36,8 @@
  *   - `exec` is the P4 placeholder leg: `"not yet implemented: exec (P4)"`.
  */
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { parseOneShotExecBody, EXEC_TAIL_WINDOW } from './exec.js';
-import { tailWindow } from './exec-pty-framing.js';
+import { parseOneShotExecBody } from './exec.js';
+import { disclose } from '../../remote/plugin.js';
 // F2 (0.1.7-n, PC 0.1.7-m first-person): the wire/registry sentinel stays
 // '[undefined]', but the DISPLAY surface must not show it to a human — D17
 // already sanctions display-layer beautification.
@@ -190,7 +190,7 @@ const DESCRIPTION = 'SuperD Hub — agent-to-agent messaging across the Super D
     '  {action:"send", agent?, conversationId?, title?, message, delivery?} → open-or-resume: omit conversationId to OPEN (then agent = the recipient, REQUIRED; title optional; message is the first turn); pass conversationId to RESUME (agent optional — the hub derives the route; a wrong agent is refused). Receipt {outcome: delivered|accepted|failed, messageId, conversationId, sessionId, created, error?, note?}: `delivered` = end-to-end complete; `accepted` = the hub took it and the SAME in-flight request keeps running (its `delivered`/`undelivered` outcome arrives as a notice — do not resend); `failed` = immediate rejection.\n' +
     '  {action:"read"} → sweep messages buffered for this session while it was not live.\n' +
     '  {action:"stop", conversationId, agent?, scope?} → cancel the conversation\'s ACTIVE turn (the session owner is derived from the conversation id; agent is optional). `stopped:true` means this call cancelled a live turn; a turn that finished on its own is IDLE, never `stopped` — so stop answers stopped:false with a note when nothing was running.\n' +
-    '  {action:"exec", cmd, machine?, cwd?, stdin?, timeoutSec?, mode?} → run one shell command on a remote machine (machine required; self/local execution disabled unless localExec is explicitly enabled). mode "oneshot" (default): {exit, stdout (last 30k), stderr, durationMs, truncated, timedOut, outcome}; cwd sets its working directory. String stdin is piped and closed in oneshot; in PTY it is written immediately after cmd (REPL input, not script mode). Hub oneshot hard retention is 4MiB bytes per stream, PTY is 4,000,000 UTF-16 code units. outputStats reports real total/retained/dropped/returned and units; discarded head cannot be recovered by restarting. mode "pty": a PERSISTENT shell per (your session, machine) — the shell OWNS its cwd and env and they SURVIVE across dispatches (cd once inside the command, then keep working); {output (tail 30k), exit, cwd, timedOut, reconnected, durationMs}. cwd is oneshot-only: passing it with mode "pty" is refused (use `cd <dir> && …` inside the command). Prefer oneshot for independent commands; pty when shell state matters.\n' +
+    '  {action:"exec", cmd, machine?, cwd?, stdin?, timeoutSec?, mode?} → run one shell command on a remote machine (machine required; self/local execution disabled unless localExec is explicitly enabled). mode "oneshot" (default): {exit, stdout (full up to 4MiB retention; beyond it the retained tail plus outputStats), stderr, durationMs, truncated (retention eviction only), timedOut, outcome}; cwd sets its working directory. String stdin is piped and closed in oneshot; in PTY it is written immediately after cmd (REPL input, not script mode). Hub oneshot hard retention is 4MiB bytes per stream, PTY is 4,000,000 UTF-16 code units. outputStats reports real total/retained/dropped/returned and units; discarded head cannot be recovered by restarting. mode "pty": a PERSISTENT shell per (your session, machine) — the shell OWNS its cwd and env and they SURVIVE across dispatches (cd once inside the command, then keep working); {output (full up to 4M UTF-16 units; beyond it the retained tail plus outputStats), exit, cwd, timedOut, reconnected, durationMs}. cwd is oneshot-only: passing it with mode "pty" is refused (use `cd <dir> && …` inside the command). Prefer oneshot for independent commands; pty when shell state matters.\n' +
     'Addresses are "<m4>-<a6>" (machine-agent); call agents first to list valid ids. delivery: "queue" (default) is injected into the peer\'s session as a waking turn — it never interrupts an active turn, it queues behind it; "steer" submits steering for the peer\'s nearest step boundary — use it only when urgency demands. NEVER poll for a reply: the peer\'s reply arrives in this conversation as a new message WHEN THE PEER SENDS one (peers that never use the channel get their last output at turn end delivered as their reply instead, form=transcript); a turn that ends with no channel artifact yields one notice whose reason= distinguishes peer-silent (ended, said nothing) / peer-error (stream died or turn aborted) / stopped-by-initiator (you stopped it). read only sweeps what was buffered while this session was down. stop is a hard stop of the peer\'s active turn (the UI stop button); scope "session" degrades to turn-only — no session-close exists upstream — and the conversation stays resumable: send again to resume it. agent_status reads a cache refreshed by the 5-minute sweep (collectedAt says when); the window is alive-first, ≤5 rows, newest first, and not being in it implies nothing; a `note` says why when the window has no collection behind it (the last collection failed, or none has happened yet). MESSAGING HAS NO STATUS QUERY: to check whether a peer is idle or running, call agent_status (a 5-minute cache — never a delivery receipt); if that is not enough and you cannot wait, send another message.';
 /**
  * Build the one SuperD Hub tool.
@@ -284,8 +284,8 @@ export function createSuperdHubTool(deps) {
                     count: { type: 'integer' },
                     messages: { type: 'json', description: 'read sweep: buffered messages with from as "<m4>-<a6>"' },
                     exit: { type: 'json', description: 'exec: the command exit code (null when killed by timeout/signal)' },
-                    stdout: { type: 'json', description: 'exec: the last 30k of stdout' },
-                    stderr: { type: 'json', description: 'exec: the last 30k of stderr' },
+                    stdout: { type: 'json', description: 'exec: full stdout up to retention (4MiB bytes; PTY 4,000,000 UTF-16 units)' },
+                    stderr: { type: 'json', description: 'exec: full stderr up to retention (4MiB bytes)' },
                     durationMs: { type: 'integer', description: 'exec: wall-clock duration' },
                     outputStats: { type: 'json', description: 'exec per-stream counters with explicit bytes/utf16 units; total, retained, dropped head, returned payload (excludes banners), retentionLimit. Absent on older peers: exact metrics unavailable.' },
                     truncated: { type: 'boolean', description: 'exec: a stream\'s total output exceeded the returned tail window' },
@@ -422,7 +422,7 @@ export function createSuperdHubTool(deps) {
                         const machine = args.machine ?? deps.exec.selfM4();
                         try {
                             const r = await deps.exec.pty(sessionKey, machine, args.cmd, { ...(args.timeoutSec === undefined ? {} : { timeoutSec: args.timeoutSec }), ...(args.stdin === undefined ? {} : { stdin: args.stdin }) });
-                            const out = tailWindow(r.output, EXEC_TAIL_WINDOW, r.outputStats?.stdout);
+                            const out = disclose(r.output, r.outputStats?.stdout); // 0.3.2-e: 全量返回，仅 retention 驱逐打 banner
                             return {
                                 action,
                                 mode: 'pty',

package/superd-hub/dist/remote-provider.js

@@ -1,13 +1,28 @@
 import { createRemoteFileEndpoint } from './remote-file-rpc.js';
 import { startRemoteProcess } from './remote-job-client.js';
+/** Hub transport implementation. HTTP/WS/pool mechanics stay in the existing exec modules. */
+import { PtySession, buildHubPtyArgv, hubPtyAssets } from '../../remote/plugin.js';
+// ws 模块绝对路径：在 superd-hub 上下文解析（分叉的 proven 链——闭包/泵子树解析不到，
+// 0.3.2-c 定稿：按名解析只在 transport 侧做一次，经 ptyEndpoint/argv 下传）。
+const wsModulePath = () => {
+    try {
+        return createRequire(import.meta.url).resolve('ws');
+    }
+    catch (error) {
+        throw new Error(`[E_HUB_PTY_SETUP] superd-hub: the ws module could not be resolved from the hub tree — hub PTY spawns a local pump child that opens the peer WebSocket with ws; ${error instanceof Error ? error.message : String(error)}`);
+    }
+};
+import { randomUUID } from 'node:crypto';
+import { createRequire } from 'node:module';
 import { ensureSelf, listRemotes } from './machines.js';
 import { cookieOf } from './mesh-link.js';
 import { runOneShotExec, postOneShotExec, parseOneShotExecBody } from './exec.js';
-import { PtyPool } from './exec-pty-session.js';
-import { LocalScriptChannel, WsPtyChannel } from './exec-pty-channel.js';
 import { PTY_EXEC_PATH } from './exec-pty-rpc.js';
 /** One shared initiator implementation for legacy tool and the optional remote service. */
 export function createHubExec(home, log) {
+    // 0.3.2-c（Q2）：分叉 exec-pty-session 已删——本 face 与 remote 工具共用 canonical
+    // PtySession（闭包导出）。per-owner 每机器一个持久 shell（A2A 语义保持：cwd/env 跨调用存活；
+    // dead → dispatch 内部重连 = 旧 markDead/重启；disposed → 下次调用重建）。
     const owners = new Map();
     let closed = false;
     const assertOpen = () => { if (closed)
@@ -21,6 +36,16 @@ export function createHubExec(home, log) {
             throw new Error(`exec is disabled for machine "${machine}" on this registry row (enabled/execEnabled=false)`);
         return row;
     };
+    const genCommandId = () => `remote-${randomUUID().replace(/-/g, '').slice(0, 16)}`;
+    const createPtySession = (machine, row, owner) => new PtySession({
+        key: `${owner}|hub-pty:${machine}`,
+        argv: row === undefined
+            ? ['script', '-qfec', 'bash', '/dev/null']
+            : buildHubPtyArgv({ url: `${row.origin.replace(/^http/, 'ws')}${PTY_EXEC_PATH}`, cookie: cookieOf(row.id, home) ?? '', wsPath: wsModulePath() }, hubPtyAssets()),
+        id: `p-${randomUUID().slice(0, 8)}`,
+        connection: row === undefined ? 'local' : `hub:${machine}`,
+        idleTtlSec: 900,
+    });
     const face = {
         selfM4: () => ensureSelf(home, 'local').id,
         run: input => { assertOpen(); return runOneShotExec(input, log); },
@@ -37,14 +62,34 @@ export function createHubExec(home, log) {
             const row = machine === face.selfM4() ? undefined : remote(machine);
             let pool = owners.get(owner);
             if (!pool)
-                owners.set(owner, pool = new PtyPool({ idleTtlSec: 600 }));
-            const key = `${machine}|${row?.origin ?? 'local'}`;
-            const session = pool.getOrCreate(key, () => row
-                ? new WsPtyChannel(`${row.origin.replace(/^http/, 'ws')}${PTY_EXEC_PATH}`, { cookie: cookieOf(row.id, home) })
-                : new LocalScriptChannel());
-            const result = await session.dispatch(cmd, opts);
-            log?.('info', 'exec.pty.run', { machine, cmd: cmd.slice(0, 120), exit: result.exit ?? 'none', durationMs: result.durationMs });
-            return result;
+                owners.set(owner, pool = new Map());
+            const attempt = async (session) => {
+                const r = await session.dispatch(cmd, { stdin: opts.stdin, timeoutSec: opts.timeoutSec, commandId: genCommandId() });
+                // P4 handoff（超时不杀）对 A2A 面保持旧语义：显式两段 ^C 后等帧结算——分叉自动中断的等价物。
+                if (r.running === true && r.job !== undefined) {
+                    r.job.interrupt();
+                    const settled = await r.job.done;
+                    return { output: settled.output, outputStats: settled.outputStats, exit: settled.exit, cwd: settled.cwd, timedOut: true, reconnected: r.reconnected, durationMs: r.durationMs, commandId: r.commandId };
+                }
+                return r;
+            };
+            const settle = (result) => {
+                log?.('info', 'exec.pty.run', { machine, cmd: cmd.slice(0, 120), exit: result.exit ?? 'none', durationMs: result.durationMs });
+                return result;
+            };
+            const existing = pool.get(machine);
+            if (existing !== undefined && existing.sessionState !== 'disposed')
+                return settle(await attempt(existing));
+            const session = createPtySession(machine, row, owner);
+            pool.set(machine, session);
+            try {
+                return settle(await attempt(session));
+            }
+            catch (err) {
+                if (session.sessionState === 'disposed' && pool.get(machine) === session)
+                    pool.delete(machine); // init 失败/auto-dispose 不留死项
+                throw err;
+            }
         },
     };
     return {
@@ -52,12 +97,11 @@ export function createHubExec(home, log) {
         async releaseOwner(owner) {
             const pool = owners.get(owner);
             if (pool) {
-                await pool.disposeAll();
-                if (owners.get(owner) === pool)
-                    owners.delete(owner);
+                await Promise.all([...pool.values()].map(s => s.dispose()));
+                owners.delete(owner);
             }
         },
-        async dispose() { closed = true; await Promise.all([...owners.values()].map(p => p.disposeAll())); owners.clear(); },
+        async dispose() { closed = true; await Promise.all([...owners.values()].flatMap(p => [...p.values()].map(s => s.dispose()))); owners.clear(); },
     };
 }
 export function createHubRemoteTransport(home, log) {
@@ -67,25 +111,10 @@ export function createHubRemoteTransport(home, log) {
     const fileAbort = new AbortController();
     const files = new Set();
     const processes = new Map();
-    const pending = new Map();
     const requireRemote = (machine) => {
         if (!machine || machine === exec.face.selfM4())
             throw new Error('Select a remote machine from the Hub roster; local execution is not available through remote');
     };
-    const track = async (owner, work) => {
-        let set = pending.get(owner);
-        if (!set)
-            pending.set(owner, set = new Set());
-        set.add(work);
-        try {
-            return await work;
-        }
-        finally {
-            set.delete(work);
-            if (!set.size)
-                pending.delete(owner);
-        }
-    };
     return {
         protocol: 1,
         listTargets: () => listRemotes(home).filter(r => r.id !== exec.face.selfM4()).map(r => ({ id: r.id, label: r.name, execEnabled: r.enabled && r.execEnabled !== false })),
@@ -110,12 +139,17 @@ export function createHubRemoteTransport(home, log) {
                 processes.delete(owner); });
             return process;
         },
-        async pty(machine, cmd, owner, options) {
+        ptyEndpoint(machine) {
             requireRemote(machine);
-            if (closed || released.has(owner))
-                throw new Error('Hub remote owner disposed');
-            const { output, ...result } = await track(owner, exec.face.pty(owner, machine, cmd, { timeoutSec: options.timeout, stdin: options.stdin }));
-            return { mode: 'pty', target: `hub:${machine}`, ...result, stdout: output };
+            if (closed)
+                throw new Error('Hub remote provider disposed');
+            const row = listRemotes(home).find(r => r.id === machine);
+            if (!row)
+                throw new Error(`unknown machine "${machine}"`);
+            if (!row.enabled || row.execEnabled === false)
+                throw new Error(`exec is disabled for machine "${machine}"`);
+            // P10：创建与每次 dispatch 都重取本端点（driver 侧调用）——pairing 复用不豁免。
+            return { url: `${row.origin.replace(/^http/, 'ws')}${PTY_EXEC_PATH}`, cookie: cookieOf(row.id, home) ?? '', wsPath: wsModulePath() };
         },
         fileEndpoint(machine) {
             requireRemote(machine);
@@ -135,7 +169,7 @@ export function createHubRemoteTransport(home, log) {
             const owned = [...processes.get(owner) ?? []];
             for (const process of owned)
                 process.cancel('owner released');
-            await Promise.all([exec.releaseOwner(owner), ...owned.map(p => p.done), ...pending.get(owner) ?? []]);
+            await Promise.all([exec.releaseOwner(owner), ...owned.map(p => p.done)]);
         },
         async dispose() {
             closed = true;
@@ -145,7 +179,7 @@ export function createHubRemoteTransport(home, log) {
             for (const process of owned)
                 process.cancel('provider disposed');
             await exec.dispose();
-            await Promise.allSettled([...owned.map(p => p.done), ...[...pending.values()].flatMap(s => [...s])]);
+            await Promise.allSettled([...owned.map(p => p.done)]);
         },
     };
 }

package/superd-hub/dist/rpc.d.ts

@@ -37,6 +37,11 @@ export interface AgentRuntimeDeps {
  * ADDITIVE contract (mesh P1): the GET body gained `hub: {machineId, label,
  * version}` and every `agents` row gained `id` (a6); `available` and all
  * pre-existing agents fields are unchanged — old clients ignore the new
+ * fields, new clients read them. Live-install staleness (2026-10-18): the
+ * hub block also carries `fusion` — the fusion row's armed state — so a
+ * page that booted before super-dsh was installed can tell its own
+ * staleness apart from a flag-off deployment and reload once (switch-core
+ * `fusionReloadDecision`).
  * fields, new clients read them.
  * @param request - the incoming `/api/agent-runtime` request.
  * @param source - live runtime registry view.

package/superd-hub/dist/rpc.js

@@ -3,6 +3,7 @@ import { PACK_VERSION } from './pack-version.js';
 import { listRuntimeKeys } from './targets.js';
 import { agentLinks } from './agent-roster.js';
 import { ensureSelf } from './machines.js';
+import { fusionTransportArmed } from './fusion-transport.js';
 /** The shared-channel Fetch route path this RPC face owns. */
 export const AGENT_RUNTIME_RPC_PATH = '/api/agent-runtime';
 /** The live registry view: native plus every registered foreign context. */
@@ -27,6 +28,11 @@ function json(status, body) {
  * ADDITIVE contract (mesh P1): the GET body gained `hub: {machineId, label,
  * version}` and every `agents` row gained `id` (a6); `available` and all
  * pre-existing agents fields are unchanged — old clients ignore the new
+ * fields, new clients read them. Live-install staleness (2026-10-18): the
+ * hub block also carries `fusion` — the fusion row's armed state — so a
+ * page that booted before super-dsh was installed can tell its own
+ * staleness apart from a flag-off deployment and reload once (switch-core
+ * `fusionReloadDecision`).
  * fields, new clients read them.
  * @param request - the incoming `/api/agent-runtime` request.
  * @param source - live runtime registry view.
@@ -51,7 +57,20 @@ export async function handleAgentRuntime(request, source, deps) {
         const links = new URL(request.url).searchParams.get('mesh') === '1'
             ? agentLinks(home).filter((l) => l.machine === 'local')
             : agentLinks(home);
-        return json(200, { available, agents: links, hub: { machineId: self.id, label: self.label, version: HUB_VERSION } });
+        return json(200, {
+            available,
+            agents: links,
+            hub: {
+                machineId: self.id,
+                label: self.label,
+                version: HUB_VERSION,
+                // Additive (live-install staleness): `true` exactly while the fusion
+                // row is armed — the fact a pre-install page cannot read off its own
+                // HTML. Peers' `?mesh=1` probes ignore it (same additivity rule as
+                // every hub-block field before it).
+                fusion: fusionTransportArmed(),
+            },
+        });
     }
     // A POST that used to switch a global selector has no meaning any more:
     // the addressed world is the mount path of the request, not a shared value.

package/superd-hub/dist/switch-core.d.ts

@@ -9,6 +9,16 @@
  * roster-probe failure → revert to native + a visible toast, never a page
  * lock).
  *
+ * Live-install staleness (2026-10-18): the fusion flag global and the
+ * transport script are baked into the SERVED index, so a page that booted
+ * before super-dsh was installed runs the freshly hot-loaded client half
+ * against a stale page — `fusionPage()` reads false and every switch
+ * affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+ * is the pure decision behind the client half's heal: one roster answer later,
+ * reload the page once. The transport must precede app boot (its upload hook
+ * `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+ * can never arm a stale page honestly — the page must be re-served.
+ *
  * Host-half on purpose: plain TS with every effect injected through
  * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
  * imports it from `dist/` like every other host module. The client half
@@ -445,6 +455,37 @@ export interface SwitchAffordance {
  * Host-half pure logic so `test/client-switch.test.mjs` pins it from `dist/`.
  */
 export declare function switchAffordance(fusion: boolean): SwitchAffordance;
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+export declare const FUSION_RELOAD_MARKER = "superd.fusion-armed.reload";
+/** What the stale-page probe decides (the client binding executes it). */
+export type FusionReloadDecision = 
+/** Flag present — the page is armed; nothing to heal. */
+'armed'
+/** The marker is set — this tab already reloaded once; never loop. */
+ | 'already-reloaded'
+/** The host answered `hub.fusion: false` — the T-E flag-off shape; stay degraded. */
+ | 'row-off'
+/** No usable answer (old host without the additive field, or the fetch failed) — stay degraded. */
+ | 'host-silent'
+/** Stale page + an armed host — set the marker and reload once. */
+ | 'reload';
+/** The inputs of one stale-page probe decision. */
+export interface FusionReloadInput {
+    /** Whether the page carries the baked `__SUPERD_UI_FUSION__` flag global. */
+    flagPresent: boolean;
+    /** Whether {@link FUSION_RELOAD_MARKER} is already in sessionStorage. */
+    markerPresent: boolean;
+    /** The roster answer's additive `hub.fusion` field (undefined: absent). */
+    hubFusion?: unknown;
+}
+/**
+ * The live-install staleness decision (host-half pure so the node tests pin
+ * the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+ * that distinguishes a page-booted-before-install from a deliberately
+ * flag-off deployment — without it the reload would loop forever on every
+ * `enabled: false` composition (the client half loads there too).
+ */
+export declare function fusionReloadDecision(input: FusionReloadInput): FusionReloadDecision;
 /**
  * Structural slice of one roster row the Hub UI helpers read (the client
  * roster's `AgentLink` shape mirrored structurally — this module never imports

package/superd-hub/dist/switch-core.js

@@ -9,6 +9,16 @@
  * roster-probe failure → revert to native + a visible toast, never a page
  * lock).
  *
+ * Live-install staleness (2026-10-18): the fusion flag global and the
+ * transport script are baked into the SERVED index, so a page that booted
+ * before super-dsh was installed runs the freshly hot-loaded client half
+ * against a stale page — `fusionPage()` reads false and every switch
+ * affordance stays hidden until a manual restart. {@link fusionReloadDecision}
+ * is the pure decision behind the client half's heal: one roster answer later,
+ * reload the page once. The transport must precede app boot (its upload hook
+ * `__DSH_FILE_UPLOAD__` is read at construction), so a client-side flag flip
+ * can never arm a stale page honestly — the page must be re-served.
+ *
  * Host-half on purpose: plain TS with every effect injected through
  * {@link SwitchHost} — no DOM, no client imports — so `test/client-switch.test.mjs`
  * imports it from `dist/` like every other host module. The client half
@@ -488,6 +498,36 @@ export const FUSION_OFF_HINT = 'fusion off — no foreign entry';
 export function switchAffordance(fusion) {
     return fusion ? { available: true, hint: '' } : { available: false, hint: FUSION_OFF_HINT };
 }
+// ---- Live-install staleness: the once-per-session reload heal -------------
+//
+// The flag global is `webserver/index-inject` state: a page served BEFORE
+// the fusion row mounted never carries it, while the client graph hot-update
+// (dsh-client-hmr) still applies the client half to that page — the Hub row
+// appears, the selector does not, and only a manual restart healed it. The
+// heal re-boots the page ONCE (a sessionStorage marker keeps a host that
+// reports fusion but never bakes the flag from looping the tab), because the
+// transport script is boot-time by design: a stale page cannot be armed in
+// place, only re-served.
+/** The sessionStorage marker guarding the stale-page reload: one per tab session. */
+export const FUSION_RELOAD_MARKER = 'superd.fusion-armed.reload';
+/**
+ * The live-install staleness decision (host-half pure so the node tests pin
+ * the table from `dist/`). The host's `hub.fusion` field is the ONLY thing
+ * that distinguishes a page-booted-before-install from a deliberately
+ * flag-off deployment — without it the reload would loop forever on every
+ * `enabled: false` composition (the client half loads there too).
+ */
+export function fusionReloadDecision(input) {
+    if (input.flagPresent)
+        return 'armed';
+    if (input.markerPresent)
+        return 'already-reloaded';
+    if (input.hubFusion === true)
+        return 'reload';
+    if (input.hubFusion === false)
+        return 'row-off';
+    return 'host-silent';
+}
 /**
  * The active agent's display name for the Hub row's right-edge selector: the
  * roster label of the atom's `activeAgent` key — the name the selector's

package/superd-hub/dist/targets.d.ts

@@ -22,6 +22,13 @@ export interface ForeignTarget {
     key: string;
     /** The context's typertGateway service instance (or a wire adapter with the same face). */
     gateway: GatewayFace;
+    /**
+     * The world's owner browser Peer (connection.browserPeer) for in-process
+     * faces — DSH 0.2.1 gateways read peer.signal/principal on every forwarded
+     * invocation, so the hub must present the world's shared owner identity.
+     * Wire adapters (mesh federation) omit it: the far end supplies its own.
+     */
+    peer?: unknown;
 }
 /** Register (or replace) the target for a runtime key. */
 export declare function registerForeignTarget(target: ForeignTarget): void;

package/superd-hub/dist/world-lifecycle.js

@@ -48,7 +48,7 @@ export function ownWorld(ctx, entry, spawn, onFailure) {
                     unregisterForeignTarget(key);
                 setReady(key, false);
             }, `superd.world.${key}: availability`);
-            target = { key, gateway: world.get('typertGateway') };
+            target = { key, gateway: world.get('typertGateway'), peer: world.get('connection')?.browserPeer };
             registerForeignTarget(target);
             setReady(key, true);
             return world;