docs(notes): record the 0.1.7-rc.2 cohort move

Record the decision, the two artifact-verified facts (the shell's frozen module table is unchanged; the primitives patch gains @deepseek-ai/dsh-util-code-language), the native-first overlap inventory with its three kept thin extensions, and the upstream publish gap that blocks the release: @deepseek-ai/dsh@0.1.7-rc.2 cannot be installed because @deepseek-ai/dsh-web-app@0.1.7-rc.2 names @deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2, which was never published.
2026-09-28 14:24:03 +08:00 · 2026-09-24 22:31:19 +08:00
parent 30ab8692a9
commit 76d3351a6f
3 changed files with 151 additions and 0 deletions
@@ -0,0 +1,5 @@
+# Bilingual-pair consistency record (docs/i18n.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with git hash-object.
+2026-09-24-sdk-cohort-0.1.7-rc.2.md: 85c228d7ccde1a143866ac0c346cd077024d09ce
+2026-09-24-sdk-cohort-0.1.7-rc.2.zh.md: a312b80d0ef6dbb916e2e795aa2f93e4783b71af
@@ -0,0 +1,73 @@
+# Agent Note: SDK cohort 0.1.7-rc.2
+
+Status: implemented
+
+## Problem
+
+The integration line declared `0.1.7-rc.1` while the official family published `0.1.7-rc.2` on 2026-09-24 (npm `next`, host CLI out at 14:18Z), one day after the rc.1 cohort landed. Staying put would have left the family's machine-readable floor pointing at a host that stopped receiving fixes on the same day the line moved, and the release candidate is not an empty delta: the host carries a new dependency (`@deepseek-ai/dsh-experimental-auto-review`), the web app gains `dsh-schedule`, `dsh-time-context`, `dsh-client-shortcuts` and `dsh-client-ui-shortcuts`, and `dsh-client-ui-primitives` imports a further face its manifest still omits.
+
+The publish also arrived in two pieces. The SDK packages started appearing at 13:58Z and the host at 14:18Z, so a cohort check run during that window reports a half-published family; the check has to be re-run against the registry rather than inferred from a release tag.
+
+## Decision
+
+The whole cohort moves to `0.1.7-rc.2` in one change, in the isolated worktree `sdk/0.1.7-rc.2` based on the local `dev` tip (`46ee2736`, two unpushed commits ahead of `origin/dev`), so the shared checkout and the running GUI are untouched until integration. It is the second move on this line and follows [sdk-cohort-0.1.7-rc.1](2026-09-23-sdk-cohort-0.1.7-rc.1.md), whose note keeps owning the rc.1 move; this note owns rc.2 and supersedes none of it. The base carries the Electron desktop removal, which is why this cohort move has five host-floor surfaces instead of six (see below).
+
+### One cohort, one literal
+
+318 specifiers across 41 files: the fifteen family manifests, the plugin scaffold, the shared workspace package, the `dsh.engines.dsh` floors with their identical `@deepseek-ai/dsh` host peers, the release-age exclusion ledger, the two `packageExtensions` keys re-keyed to the new cohort, the root README badges, the CI and release mount-smoke pins, the cohort literals in `shared/web-platform.ts`, `shared/tests/web-platform.spec.ts`, `tests/e2e/mount.e2e.ts` and `scripts/rollout-verify.test.mjs`, and the cohort prose in `docs/publish-prep.md`, `docs/plugins.md`, `packages/dsh-web-all/aggregate.yml` and the three package README pairs (with their pairing records re-recorded). `@deepseek-ai/cordis` (4.0.4) and `@deepseek-ai/schemastery` (3.18.4) do not move: their lines are independent and the cohort's own peers still name them.
+
+### Two surfaces were verified against the published artifacts
+
+- **The frozen module table is unchanged.** Extracting `@deepseek-ai/dsh-web-frontend` at both cohort versions shows the same nine `staticModules` specifiers; only the minified identifiers differ. `shared/web-platform.ts` therefore keeps its list and moves only its provenance comment. The new `@deepseek-ai/dsh-client-shortcuts` is an ordinary client plugin injected by the sidebar and workspace rows, not a static module.
+- **The primitives patch gains a face.** `@deepseek-ai/dsh-client-ui-primitives@0.1.7-rc.2` imports `@deepseek-ai/dsh-util-code-language`, published for the first time at rc.2, and the manifest still declares no runtime dependencies. The `packageExtensions` entry adds that exact pin. The pre-existing upstream packaging defect (undeclared `immer`/`zustand` in `dsh-client-store`, and the long list in `dsh-client-ui-primitives`) survives rc.2 unchanged, so no patch is dropped.
+
+### The upstream publish gap, and how verification proceeded
+
+`@deepseek-ai/dsh@0.1.7-rc.2` **cannot be installed from npm**. `@deepseek-ai/dsh-web-app@0.1.7-rc.2` declares an exact dependency on `@deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2`, which upstream never published (that package's `next` and newest version are both `0.1.7-rc.1`), so both `npm install -g @deepseek-ai/dsh@0.1.7-rc.2` and the CI/release mount-smoke step fail with `ETARGET`. The omission is not a rename: `dsh-web-app` still lists all eleven `settings-*` rows at rc.2 and removed none, while adding four packages. All 81 direct dependencies of the host resolve; only this transitive edge is missing.
+
+The global CLI therefore stays at `0.1.7-rc.1` (npm leaves no partial state), and the host-dependent gates run against a scratch host installed into a temporary prefix with one documented override — `@deepseek-ai/dsh-client-ui-settings-account` pinned to `0.1.7-rc.1` — passed to the repository's own smoke lane through its `DSH_CMD` switch. That is enough to exercise the real rc.2 host and this checkout's built plugins; it is not enough to ship, because the release pipeline installs the pinned host with no override. **The release stays blocked until upstream publishes the missing package; this note records a repository-side cohort move that is verified but not yet releasable.**
+
+### Native-first overlap inventory
+
+The rc.2 delta was checked against the family before anything was adapted. The new official capability is additive, and every overlap candidate resolves to an existing thin extension:
+
+| Official feature (new or changed in rc.2) | Our implementation | Decision |
+| --- | --- | --- |
+| Auto review toggle on the Plugins page; Inspector no longer bundled by default; registry/mirror identification; mirror fallback when a GitHub install fails; plugin-detail fixes | `dsh-plugin-manager` (update checks, conflict ledger, repair handoff, read-only inventory) | Kept as a thin extension, unchanged. Its README already hands installing, uninstalling and switching to the official page since 0.1.7-alpha.1, and it renders the inventory read-only, so the surfaces rc.2 changes are exactly the ones this package deliberately does not own. No removal. |
+| Scheduled tasks and reminders with run history, surviving restarts, disabled by default on Web | `dsh-task-board` Host cron scheduling (5-field cron over task-board cards that run real DSH sessions) | Kept. Different object and different ledger: the official scheduler owns reminders, ours owns the task ledger and executes agent runs against it. No removal; the default-off precedent is worth mirroring in product review, not in this cohort move. |
+| Archive filtering (hide archived / all / archived only) in the conversation list | `dsh-session-archive` (status filter, search, sort, batch archive/delete, auto policies), which already owns the official `archived-sessions` section id at order 25 | Kept. The official filter governs the sidebar conversation and workspace lists; ours filters the inventory section this plugin took over at 0.1.5, and the two read different sets. Recorded as a kept exception rather than a removal, because removing our filter would regress the batch pipeline that native does not provide. |
+| Keyboard shortcuts (view/search/customize/reset) | none | No overlap; nothing to remove |
+| Time context interval; Coding Tools mode selection; account/API-key model entries; approval-card language | none as a parallel implementation | No overlap; nothing to remove |
+
+No family package implements a capability this cohort newly adds, so nothing is deleted and no capability is regressed. One caveat is recorded rather than hidden: the three kept rows were decided from the official change record and the packages' own contracts, and were exercised only to the depth the mount smoke reaches (mount, boot, no crash markers). The deeper per-surface GUI comparison that a removal would demand was not possible while the host cannot be installed from the registry.
+
+### Host-floor surfaces
+
+Five of the six surfaces named by [dsh-host-floor-tracks-cohort](2026-09-01-dsh-host-floor-tracks-cohort.md) move: the engines floors, the host peers, the root README badges, the CI/release mount pins and the `docs/publish-prep.md` sentence. The sixth — the desktop host payload pin in `desktop/runtime/host/package.json` — no longer exists on this base, because the Electron desktop application and its packaging lane were removed in `64beab4a`; there is nothing left to move, and the consistency requirement it carried is retired with it. The satellite peer floors recorded in `pnpm-lock.yaml` still read `>=0.1.7-rc.1`: they belong to the satellite packages, which move to the aligned version in their own repositories.
+
+## Alternatives considered
+
+**Wait for the missing package before bumping anything.** Rejected: the cohort move is a repository-side change whose verification does not depend on the one absent row, and holding the branch would leave the family declaring a floor the line has already left. The release is gated separately, which is where the missing package actually bites.
+
+**Ship 0.4.2 on `0.1.7-rc.1` and take rc.2 later.** Rejected by the operator: 0.4.2 carries the rc.2 cohort, so the release waits rather than shipping a cohort the SDK has already superseded.
+
+**Override the missing dependency in the release pipeline.** Rejected: the pipeline installs the pinned official host as the user installs it. An override there would ship a host composition that no user can reproduce, hiding an upstream defect behind a local patch.
+
+**Move `@deepseek-ai/cordis` and `@deepseek-ai/schemastery` with the cohort.** Rejected on the same ground as the previous cohort: neither publishes a `0.1.7-rc.2`; their lines are independent and the cohort's peers still constrain them.
+
+**Remove `dsh-plugin-manager`'s compatibility pre-check now that the official preflight decides the same question.** Still rejected, unchanged from the rc.1 record: the two rules read different fields, and the GUI evidence needed to prove the official refusal on the npm-published web runtime is unavailable while the host cannot be installed.
+
+## Consequences
+
+- The declared floor, the host peer, the badge and the CI/release mount pins all name `0.1.7-rc.2`, so the repository's stated requirement now leads what a user can install. That is deliberate and temporary: it is exactly the state the upstream gap creates, and it is recorded here rather than papered over.
+- The release of 0.4.2 is blocked on `@deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2`. Retry `npm install -g @deepseek-ai/dsh@0.1.7-rc.2` and re-run the mount smoke before cutting the tag; nothing else needs to change.
+- The satellite packages still declare `>=0.1.7-rc.1` as their host peer. They converge on the aligned version when the four satellite repositories release `0.4.2`, which the release flow requires before this repository tags.
+- Local profiles keep their `@deepseek-ai/*` shadow copies on the rc.1 cohort until the global CLI moves and the operator restarts. No profile surgery is possible or needed while the CLI cannot be installed.
+
+## Testing
+
+Run on the committed tree in the isolated worktree: `pnpm typecheck`, `sync-shared:check`, `libs:check`, `build`, `test`, `test:scripts`, `runtime-deps:check`, `aggregate:check`, `emoji:check`, `test:standards`, `docs:check` and `i18n:check` all pass; `pnpm install --frozen-lockfile --ignore-scripts` passes the supply-chain policy on 468 entries after the lockfile re-resolves to rc.2.
+
+`bash scripts/e2e-mount.sh` ran in its CI form against the scratch rc.2 host (`DSH_CMD` at the scratch install, `FAMILY_TGZS_DIR` at tarballs packed from this checkout): the aggregate mounts through `dsh plugin --profile web add`, `dsh web` boots on an OS-assigned port, and the Playwright headless lane passes — the official host frame mounts and no excluded external row appears.
+
+Not verified, and named here as the gap it is: the registry install of the pinned host, the release pipeline's own mount smoke, and the per-surface GUI comparisons behind the three kept overlap decisions. All three are blocked by the missing `@deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2`, not by this change.
@@ -0,0 +1,73 @@
+# Agent Note: SDK cohort 0.1.7-rc.2
+
+Status: implemented
+
+## 背景
+
+集成分支声明的是 `0.1.7-rc.1`，而官方家族在 2026-09-24 发布了 `0.1.7-rc.2`（npm `next`，宿主 CLI 于 14:18Z 上线），距 rc.1 cohort 落地仅一天。按兵不动会让家族的机器可读下限指向一个在同一天就停止接收修复的宿主，而且这个候选版本的内容并非空变更：宿主新增依赖 `@deepseek-ai/dsh-experimental-auto-review`，Web 应用新增 `dsh-schedule`、`dsh-time-context`、`dsh-client-shortcuts` 与 `dsh-client-ui-shortcuts`，`dsh-client-ui-primitives` 还导入了一个其 manifest 仍未声明的面。
+
+这次发布也是分两批到达的：SDK 包从 13:58Z 开始出现，宿主到 14:18Z 才上线，因此在那个窗口内做 cohort 检查会得到一个「半发布」的家族；检查必须重新查 registry，而不能凭 release tag 推断。
+
+## 决策
+
+整个 cohort 在隔离工作树 `sdk/0.1.7-rc.2` 中一次性迁到 `0.1.7-rc.2`，基线取本地 `dev` 顶端（`46ee2736`，领先 `origin/dev` 两个未推送提交），因此在整合之前共享 checkout 与运行中的 GUI 不受影响。这是该线上的第二次迁移，承接 [sdk-cohort-0.1.7-rc.1](2026-09-23-sdk-cohort-0.1.7-rc.1.md)：其记录继续拥有 rc.1 迁移，本记录拥有 rc.2，不取代前者。该基线带有 Electron 桌面端移除提交，这正是本次 cohort 迁移只有五个 host floor 面而非六个的原因（见下）。
+
+### 一个 cohort，一个字面量
+
+41 个文件、318 处 specifier：十五个家族 manifest、插件脚手架、shared 工作区包、`dsh.engines.dsh` 下限及其同字面量的 `@deepseek-ai/dsh` host peer、release-age 排除账本、re-key 到新 cohort 的两个 `packageExtensions` 键、根目录双语 README badge、CI 与 release 的挂载冒烟 pin、`shared/web-platform.ts`、`shared/tests/web-platform.spec.ts`、`tests/e2e/mount.e2e.ts` 与 `scripts/rollout-verify.test.mjs` 中的 cohort 字面量，以及 `docs/publish-prep.md`、`docs/plugins.md`、`packages/dsh-web-all/aggregate.yml` 和三个包 README 对（含重新记录的 pairing 记录）中的 cohort 表述。`@deepseek-ai/cordis`（4.0.4）与 `@deepseek-ai/schemastery`（3.18.4）不动：它们各自独立推进，且 cohort 自身的 peer 区间仍然约束它们。
+
+### 两个面是对已发布产物实测的
+
+- **冻结模块表未变。** 解包两个 cohort 版本的 `@deepseek-ai/dsh-web-frontend` 可以看到 `staticModules` 的九个 specifier 完全一致，只有压缩后的标识符不同。因此 `shared/web-platform.ts` 保留其列表，只改 provenance 注释。新的 `@deepseek-ai/dsh-client-shortcuts` 是被侧栏与工作区行注入的普通 client 插件，不是静态模块。
+- **primitives 补丁新增一个面。** `@deepseek-ai/dsh-client-ui-primitives@0.1.7-rc.2` 导入 `@deepseek-ai/dsh-util-code-language`（该包在 rc.2 首次发布），而其 manifest 仍未声明任何运行时依赖。`packageExtensions` 条目补上了这个精确 pin。既有的上游打包缺陷（`dsh-client-store` 未声明 `immer`/`zustand`，`dsh-client-ui-primitives` 的长列表）在 rc.2 原样存在，因此没有删除任何补丁。
+
+### 上游发布缺口与本次验证方式
+
+`@deepseek-ai/dsh@0.1.7-rc.2` **无法从 npm 安装**。`@deepseek-ai/dsh-web-app@0.1.7-rc.2` 精确依赖 `@deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2`，而该包上游从未发布（其 `next` 与最新版本都是 `0.1.7-rc.1`），因此 `npm install -g @deepseek-ai/dsh@0.1.7-rc.2` 与 CI/release 的挂载冒烟步骤都以 `ETARGET` 失败。这不是改名：`dsh-web-app` 在 rc.2 仍列出全部十一个 `settings-*` 行、没有删除任何一个，反而新增了四个包。宿主 81 个直接依赖全部可解析，缺的只是这一条传递边。
+
+因此全局 CLI 停在 `0.1.7-rc.1`（npm 不会留下半装状态），依赖宿主的那几道门禁改用一个 scratch 宿主运行：装进临时前缀，只加一处有据可查的覆盖——把 `@deepseek-ai/dsh-client-ui-settings-account` 钉在 `0.1.7-rc.1`——再通过仓库自带冒烟 lane 的 `DSH_CMD` 开关接入。这足以在真实 rc.2 宿主上跑通本检出构建的插件，但不足以发布，因为发布管线安装钉住的宿主时不带任何覆盖。**在上游补发该包之前发版保持阻塞；本记录描述的是一次已验证、但尚不可发布的仓库侧 cohort 迁移。**
+
+### Native-first 重叠清单
+
+rc.2 的变更在动手适配之前已逐项对照家族。新增的官方能力是增量的，每个重叠候选都落在既有的薄扩展上：
+
+| 官方能力（rc.2 新增或变更） | 本仓实现 | 决定 |
+| --- | --- | --- |
+| 插件页的自动审阅开关；Inspector 不再默认内置；官方源/镜像辨识；GitHub 安装失败时的镜像回退；插件详情修复 | `dsh-plugin-manager`（更新检查、冲突账本、修复交接、只读清单） | 按薄扩展保留、不改动。其 README 自 0.1.7-alpha.1 起就把安装、卸载与启停交给官方页面，自身只读渲染清单，因此 rc.2 改动的正是这个包刻意不占的面。不移除。 |
+| 定时任务与提醒，含运行记录、重启保留、Web 端默认关闭 | `dsh-task-board` 的 Host cron 调度（对运行真实 DSH 会话的任务卡做五段 cron） | 保留。对象与账本不同：官方调度器管提醒，我们管任务账本并对其执行 agent 运行。不移除；「默认关闭」这一先例值得在产品评审中借鉴，不属于本次 cohort 迁移。 |
+| 会话列表的归档筛选（隐藏已归档／全部／仅显示已归档） | `dsh-session-archive`（状态筛选、搜索、排序、批量归档/删除、自动策略），且已接管官方 `archived-sessions` section id（order 25） | 保留。官方筛选作用于侧栏会话与工作区列表，我们筛选的是本插件从 0.1.5 起接管的清单 section，两者读取的集合不同。登记为保留例外而非移除，因为移除我们的筛选会回退原生并不提供的批量管线。 |
+| 快捷键（查看/搜索/自定义/重置） | 无 | 无重叠，无需移除 |
+| 时间上下文间隔；Coding Tools 模式选择；账号/API Key 模型入口；审批卡语言 | 无平行实现 | 无重叠，无需移除 |
+
+没有任何家族包实现了本 cohort 新增的能力，因此不删除任何实现、不回退任何能力。一处保留如实记录而非隐藏：上述三个「保留」决定依据的是官方变更记录与各包自身契约，实际只被验证到挂载冒烟所及深度（挂载、启动、无崩溃标记）。更深的逐面 GUI 对比——也就是一次移除所必须的证据——在宿主无法从 registry 安装期间无法取得。
+
+### Host floor 面
+
+[dsh-host-floor-tracks-cohort](2026-09-01-dsh-host-floor-tracks-cohort.md) 点名的六个面中有五个随迁移移动：engines 下限、host peer、根 README 双语 badge、CI/release 挂载 pin，以及 `docs/publish-prep.md` 的冒烟说明句。第六个——`desktop/runtime/host/package.json` 的桌面包体 pin——在本基线上已不存在，因为 Electron 桌面应用及其打包 lane 已在 `64beab4a` 移除；没有可移动的对象，它携带的一致性要求也随之退役。`pnpm-lock.yaml` 中记录的卫星 peer 下限仍是 `>=0.1.7-rc.1`：它们属于卫星包，由各自仓库在对齐版本发布时更新。
+
+## 被否决的备选
+
+**等缺包发布后再 bump。** 否决：cohort 迁移是仓库侧变更，其验证并不依赖缺失的那一行，压着分支反而让家族继续声明一个该线已经离开的下限。发版是单独设卡的环节，缺包真正咬人的地方在那里。
+
+**0.4.2 先按 `0.1.7-rc.1` 发，rc.2 随后再补。** 被操作者否决：0.4.2 要带 rc.2 cohort，因此宁可让发布等待，也不发一个 SDK 已经取代的 cohort。
+
+**在发布管线里覆盖缺失依赖。** 否决：管线按用户的方式安装钉住的官方宿主。在那里加覆盖会发出一个没有任何用户能复现的宿主组合，把上游缺陷藏在本地补丁后面。
+
+**把 `@deepseek-ai/cordis` 与 `@deepseek-ai/schemastery` 一起移动。** 与上一个 cohort 同理否决：两者都没有发布 `0.1.7-rc.2`；各自线路独立，cohort 的 peer 仍然约束它们。
+
+**既然官方 preflight 回答了同一个问题，就移除 `dsh-plugin-manager` 的兼容性预检。** 仍否决，与 rc.1 记录一致：两条规则读取的字段不同，而证明官方在 npm 发布的 web 运行时上确实拒装所需的 GUI 证据，在宿主装不上期间不可得。
+
+## 后果
+
+- 声明下限、host peer、badge 与 CI/release 挂载 pin 全部指向 `0.1.7-rc.2`，于是仓库声明的要求领先于用户实际可安装的版本。这是有意的过渡状态：它正是上游缺口造成的局面，此处如实记录而非掩盖。
+- 0.4.2 的发版阻塞在 `@deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2`。打 tag 前重试 `npm install -g @deepseek-ai/dsh@0.1.7-rc.2` 并重跑挂载冒烟即可，其余无需改动。
+- 卫星包仍以 `>=0.1.7-rc.1` 声明 host peer。四个卫星仓库发布对齐后的 `0.4.2` 时它们自然收敛，而发版流程要求这一步先于本仓打 tag。
+- 在全局 CLI 迁移并重启之前，本地 profile 的 `@deepseek-ai/*` 影子副本继续停留在 rc.1 cohort。CLI 装不上期间，profile 手术既不可能也非必需。
+
+## 验证
+
+在隔离工作树的提交树上运行：`pnpm typecheck`、`sync-shared:check`、`libs:check`、`build`、`test`、`test:scripts`、`runtime-deps:check`、`aggregate:check`、`emoji:check`、`test:standards`、`docs:check` 与 `i18n:check` 全部通过；锁文件重解析到 rc.2 后，`pnpm install --frozen-lockfile --ignore-scripts` 在 468 个条目上通过供应链策略。
+
+`bash scripts/e2e-mount.sh` 以 CI 形态对 scratch rc.2 宿主运行（`DSH_CMD` 指向 scratch 安装，`FAMILY_TGZS_DIR` 指向本检出打包的 tarball）：聚合包经 `dsh plugin --profile web add` 挂载，`dsh web` 在 OS 分配端口启动，Playwright 无头 lane 通过——官方宿主帧完成挂载，且没有出现被排除的外部行。
+
+以下未经验证，并在此明确记为缺口：钉住的宿主从 registry 安装、发布管线自身的挂载冒烟，以及三个「保留」重叠决定背后的逐面 GUI 对比。这三项都被缺失的 `@deepseek-ai/dsh-client-ui-settings-account@0.1.7-rc.2` 阻塞，而不是被本次变更阻塞。