- Content blocks render in the order the model received them. Partitioning
hoisted every unknown block past the text around it, so an interleaved log
read back in an order the model never saw.
- A delta distinguishes a newly reconciled file from a rewritten one; `set`
and `replace` already separate them at the producer, and collapsing both to
"updated" misread a new file.
- The superseded note states current fact in its consequences and testing
rather than keeping claims the implementation now contradicts, per
implemented/AGENTS.md; the decision itself stays as the record of that
change, with the supersession pointer above it.
- An empty replacement catalog is a real catalog: `renderCatalogUpdate()`
publishes zero entries when the last skill disappears, and falling back
would hide that every earlier name was retired.
- The opaque fallback keeps a `form` declaration this version cannot present.
It is the one place a newer or foreign log's declared shape would otherwise
vanish from the UI entirely, since the row marker is also absent there.
- An instruction change with an unrecognized `action` disqualifies the record.
The action decides the word the row shows, so an unknown one would be
presented as loaded or updated.
- The catalog list bounds itself and reports the withheld count. Entry count
is unbounded and the scrollport bounds height, not node count.
- A catalog message keeps content blocks this version does not know, instead
of dropping model-visible content the extensible union may carry.
- `core.md` defines `ContextFormed`, the interface actually carrying the
optional field, beside `ContextForm`.
- The superseded-in-part bullet states the affected clauses as one rule rather
than enumerating them; two rounds of enumeration each missed some, which is
the shape being fragile rather than the list being wrong.
- The note records the one migration case that does not self-heal: an
old-format catalog as the only one, with an empty current view, leaves a
stale catalog nothing replaces.
Master's #1369 deleted the TUI, the meta and upgrade subcommands, and the
whole-tree --config-replace path. These notes were written before that landed
and still promised a flag the CLI no longer registers, and named it as the
lever a deployment uses to pin a field against a user's stored settings —
which now has no CLI equivalent at all.
State what shipped: every booting surface takes --config, dsh -p is the
surface this change actually gave it to, and a deployment that must win
against stored settings ships its own bin or loader tree. Each note
cross-links #1369's own note rather than restating the removal, and the
shared-base note moves its --config-replace sentences to past tense.
The win32 tier is exactly the koffi IFileOpenDialog child process; any failure surfaces as-is. The pwsh -> Windows PowerShell 5.1 cascade, the shared WinForms script, and the triple-miss AggregateError are deleted: koffi is a packaged dependency whose availability the install guarantees, so no mechanism fallback exists (the browse backend remains the fallback at the composition level). The pwsh-first DPI picker-fix note is consolidated into a new simplification note recording the reversal.
Review follow-ups on the context provenance row:
- the producer name now follows ToolRow's aria-hidden separator dot instead
of a literal middot inside the text, so the two disclosure rows expose one
accessible-name shape;
- the English steering caption becomes the noun `Interjection`, parallel to
the Chinese 插话 and to the label this bubble carried before;
- the history fold gets its own provenance assertion, so the mapping it
declares separately from TranscriptAdapter is pinned on both sides;
- the superseded-in-part bullet on the no-interjection-chrome note now
enumerates the third Decision bullet too, whose no-badge and no-IconActions
clauses had both lapsed.
Master removed the TUI package, the `meta` and `upgrade` subcommands, and
`--config-replace`, and made raw `dsh` require a `--config` overlay. Resolved
onto that shape:
- Dropped this branch's TUI edits with the surface itself, including
`tui.cordis.yml`, `runTui`, and the TUI keyless PTY smoke.
- Dropped the `--config-replace` plumbing rather than reintroducing a flag
master deliberately removed. The gap this branch fixed remains: `dsh -p`
still could not name its composition, so it keeps `--config`.
- Kept this branch's deletion of the personal `$DSH_HOME/config.yaml` layer,
which master still carried, and provided the environment snapshot in the new
raw `runConfig` surface alongside web and headless.
- Ported the headless shutdown PTY test off the personal overlay onto a named
`--config` file, which is what proves that flag now exists on `-p`.
Every logged non-user user/message collapsed into one identical
「上下文注入」 row, and mid-turn steering rendered in exactly the bubble a
turn-opening prompt uses, so the transcript could not say what had been
added or which message interrupted a running turn.
TranscriptAdapter and the history fold now attach a provenance view to
each context node, computed by contextProvenance() from the durable
source alone: a role (inject, or recall for a cross-session snapshot)
and a producer name read out of the log — instruction paths for
workspace-instructions, session titles for session-reference, the plugin
id for a plugin source, and the bare kind for any other. No client-side
table of producer names, so a renamed or newly mounted producer stays
identifiable without a client release and a foreign log projects like a
live one. ContextInjectionRow titles itself from the role and shows the
name beside it; MessageItem captions durable and pending steering
bubbles.
The caption reverses one clause of the no-interjection-chrome decision,
which removed it because the composer could not steer; composer steering
shipped afterwards without amending that note, so this change supplies
the product decision its reintroduction clause required and corrects the
stale facts left in it.
Fixes#1291
$DSH_HOME/config.yaml was an implicit composition layer: if the file existed,
every launch applied an arbitrary Loader patch graph over the shipped tree,
kept live by a dedicated HMR watcher. Three costs came from the implicitness,
not the capability. A patch replaces its target row's whole config, so a file
written months ago pins that row to the field set it knew and every default
the shipped tree later adds silently stops applying. It competed with the
typed settings namespaces llm-deepseek and llm-pi-ai already register, so
which one wins was a function of layer order rather than meaning. And the
explicit escape hatch it was supposedly redundant with did not exist on every
surface: dsh -p, dsh meta, and dsh upgrade all rejected --config, so for them
the implicit file was the only composition route at all.
Complete the explicit layer first: --config and --config-replace now work on
every booting surface. A headless --config-replace tree must still mount a
webserver row, because that surface reaches its own agent over the same HTTP
gateway the browser uses; AppCLIEntry names that contract in the failure
instead of reporting a bare missing service.
Then delete the implicit one. PERSONAL_CONFIG_FILENAME, loadPersonalPatches,
watchPersonalPatches, and the config-only HMR row mounted for it are gone; a
file left at that path is inert, and --dump-config no longer reads the Harness
home. --config therefore stops *replacing* the personal overlay and simply
*is* the user overlay.
No migration: a user who wants the old behavior names the same file
(dsh --config ~/.dsh/config.yaml), which a shell alias makes permanent.
`./.dsh-tmp-profile/config.json` was the web config-tree boot's user-config
plane, but never gained a writer: no production code created or edited it, no
test exercised it, and no user documentation named it. The fields it mapped
have owners elsewhere — provider/model are the api-gateway's default route and
persistenceRoot is an assembly fact, while typed user preferences live in
$DSH_HOME/settings.yaml.
Delete PROFILE_DIR, PROFILE_FILE, ProfileMapping, PROFILE_MAPPINGS, and
readProfile() with the patch source that consumed them. AppCLIEntry now
composes patches from CLI flags and the resolved frontend distIndex only; the
surrounding layers are unchanged. A file on disk is ignored completely — no
migration, replacement format, or deprecation diagnostic, per the pre-release
stance.
- gen-cordis-catalog / gen-persistence-catalog / gen-doc-graphs after the
error-reason and steering/message changes (line anchors and event
producer/consumer graph drifted).
- verify-translation-pairing --write --all: every bilingual pair touched
by the PR (agent notes, session/core docs, READMEs) plus the merge.
- queue-actions preserved golden re-recorded against the rebuilt client
(branch disabled on non-completed-turn tails is back in effect).
next-step items now split by origin: user-origin messages keep the
'steering' placement, while agent.inject context (approval notices, task
completion notices, attached snapshots) carries a new 'context' placement
that no surface renders until it is claimed as a durable user/message
context card. Widen the placement unions on the wire and in the client
runtime, add a projection test case, and document the split in the
apiproxy/ui-conversation READMEs and the web-steer chrome agent note.
Steer, inject, and followup now land as durable user/message events on the
session surface; the steering/message event type and its ConversationNode
kind are removed from the client projection. Update tests, docs, generated
catalogs, and agent notes to match, and align the steering e2e fixture and
prompt inventory assertions with the durable user/message landing.
The PR appended a superseded warning to one obsolete durability clause while leaving the same active decision record with mutually incompatible claims about Task-backed continuations, provider resume dispatch, and persistence guarantees. Because implemented Agent Notes are current authority rather than a review-history log, readers could still derive an API and ownership model that no longer exists.
Rewrite the affected decision, alternatives, and consequences in place around the activation-based implementation: ordinary starts remain holder-owned one-shot runs; continuable starts return durable child and accepted message identities; the manager owns materialization, follow-up/report routing, cold resume, and teardown; providers only contribute detached first-create data through prepareContinuable; and flush participation is observable but is not proof that a persistence backend stored state.
Keep the English and Chinese records equivalent, move the Chinese dispose glossary to its new first use, and refresh the pairing sidecar. This commit changes documentation authority only; it does not change runtime behavior.
Validated with the scoped translation-pairing writer and checker, verify-md-wrap, verify-agent-note-format, verify-agent-note-classification, and git diff --cached --check.
Two pairs needed their confirmed-consistent state refreshed: the
intent-named note's supersession clause (zh link normalized to the shared
`.md` target, since the pairing contract requires identical link targets)
and the report README's acceptance-semantics rewrite (both sides edited).
Re-record both pairs so the translation-pairing gate passes.
The 2026-07-27 intent-named operations note still declared that a
continuable provider requires `flush()` to resolve `true` at its final
result boundary and maps `false`/rejection to `DURABILITY_FAILED`. The
activation-based record (2026-07-28-continuable-subagent-conversations)
superseded that contract: the manager awaits the final flush as a
best-effort barrier and deliberately ignores the boolean, because listener
participation cannot identify a persistence backend.
Active notes are the current source of truth — sync both sides of the
bilingual pair by marking the old clause superseded with a link to the
record that replaced it.
Moves the RFC to implemented/, restates it as current-state prose under the
implemented note format, and records what the Task-backed continuable-subagents
note and the two subagent-service simplification notes retain versus what this
record replaces.
Yichen Jiang