diff --git a/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.i18n.yaml
index f5d261079d..cabffaebf6 100644
--- a/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.md
-2026-07-29-dsh-source-launch-tsx-esm.md: 5401b0257faa69eaf76b11e7b51d06afd7ec2b8c
-2026-07-29-dsh-source-launch-tsx-esm.zh.md: f32fa3ece91bf7b9829d7012ceb090cabaa833a9
+2026-07-29-dsh-source-launch-tsx-esm.md: 700577cb9b137d67f20baeb639f99f4c0877011d
+2026-07-29-dsh-source-launch-tsx-esm.zh.md: 4d322d3dcf49442ee62f82203f17bd2ab16467fe
diff --git a/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.md b/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.md
index 5401b0257f..700577cb9b 100644
--- a/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.md
+++ b/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.md
@@ -14,11 +14,13 @@ Startup latency also mattered: the off-thread `module.register()` hooks worker s
 
 ## Decision
 
-The `dsh` TUI, Web, and headless source launches run `node --import tsx/esm`: tsx's ESM-only hook owns both TypeScript transformation and tsconfig `paths` projection. The root `dsh` script uses that vector directly from the repository root; artifact generation is a separate operation under the [source-launch/build separation decision](../../archived/simplification/2026-08-12-separate-source-launch-from-build.md). The CJS hook stays off because the CLI source graph is ESM-only; measured runtime launch to the TUI banner is ~0.7s versus ~1.1s under the full tsx default and ~0.75s under the removed native chain.
+The `dsh` CLI source launches run `node --import tsx/esm`: tsx's ESM-only hook owns both TypeScript transformation and tsconfig `paths` projection. The root `dsh` script uses that vector directly from the repository root; artifact generation is a separate operation under the [source-launch/build separation decision](../../archived/simplification/2026-08-12-separate-source-launch-from-build.md). The CJS hook stays off because the CLI source graph is ESM-only; the implementation-time measurement to the TUI banner was ~0.7s versus ~1.1s under the full tsx default and ~0.75s under the removed native chain.
 
-`scripts/tspath-loader.ts` and `apps/cli/src/tsconfig-paths-loader.ts` are deleted. With them went the loader's runtime rule of mapping a workspace import only for declared runtime dependencies — tsx applies the `paths` map unconditionally. Declaration completeness now rests on the static gates alone: `verify-cordis-config` for configured bare plugins, and workspace constraints for manifests. (That runtime rule found real bugs: `dsh-plan-mode` and `dsh-tool-jobs` imported `@deepseek-ai/dsh-llm` while declaring it only in devDependencies; since fixed.)
+tsx owns workspace `paths` mapping without checking whether the importer declares each package as a runtime dependency. Declaration completeness rests on the static gates: `verify-cordis-config` for configured bare plugins, and workspace constraints for manifests. The removed repo-owned paths loaders enforced those declarations at runtime and caught imports of `@deepseek-ai/dsh-llm` declared only in devDependencies; tsx does not provide that check.
 
-The node-compat CI matrix (Node 22.19 and 26) gains `dsh-source-launch-smoke` (`apps/cli/tests/source-launch.compat.spec.ts`): a keyless piped-stdio launch of the exact production runtime vector asserting the non-zero-exit TTY refusal. Any future Node change to module hooks or TypeScript handling turns this gate red instead of breaking developers' `pnpm dsh`.
+tsx skips the paths map when the importer URL contains `/node_modules/`. The [runtime resolution](2026-09-09-profile-resolution-generations.md) therefore records real declaring-package anchors, including recursive dependencies. This lets workspace fallback imports resolve to `src/` consistently, rather than mixing built `lib/` providers with source callers whose module-local Symbols differ. Packages without a workspace mapping retain ordinary export resolution.
+
+The node-compat CI matrix runs `dsh-source-launch-smoke` (`apps/cli/tests/source-launch.compat.spec.ts`) without a build: keyless launches assert the required-profile diagnostic and profile dependency resolution without mixed Tools/AgentLoop `src/` and `lib/` instances. The source and built-bin suites share ordinary-directory and npm-link profile cases; the latter launches plain Node against built exports. The required build-backed smoke also runs `apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts`: it checks real headless tool dispatch through tsx after the native addon and generated typert contributors are available, while still requiring core workspace modules to load from source. Future changes to module hooks or TypeScript handling are checked through these real entry paths.
 
 ## Alternatives considered
 
@@ -35,4 +37,4 @@ The node-compat CI matrix (Node 22.19 and 26) gains `dsh-source-launch-smoke` (`
 - One launch vector across the whole engines range, including future Node lines that change native TypeScript support; the smoke gate enforces it per matrix line.
 - TypeScript transformation is delegated to tsx/esbuild again, reversing the prior note's goal of proving Node-native transformation; that goal is unreachable while vendored sources use non-erasable syntax and Node ships no transform mode.
 - The runtime declared-dependency enforcement in source launches is gone; undeclared workspace imports now surface only through static gates or built-mode resolution failures.
-- Runtime launch improves ~0.4s over the full tsx default; ACP keeps `--import tsx` because its graph was not audited for CJS-hook dependence and its launch latency is not on the interactive path.
+- Every CLI source profile uses the same ESM-only hook, including ACP. Workspace runtime entries reached by this launch must expose ESM exports; the launcher does not install a CJS TypeScript transform hook.
diff --git a/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.zh.md b/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.zh.md
index f32fa3ece9..4d322d3dcf 100644
--- a/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.zh.md
+++ b/.agents/notes/implemented/architecture/2026-07-29-dsh-source-launch-tsx-esm.zh.md
@@ -14,11 +14,13 @@ Status: implemented
 
 ## 决策
 
-`dsh` 的 TUI、Web 与无头源码启动运行 `node --import tsx/esm`：由 tsx 的 ESM-only 钩子同时负责 TypeScript 转换与 tsconfig `paths` 投影。根目录的 `dsh` 脚本直接从仓库根目录使用同一启动方式；产物生成是独立操作，由[源码启动与构建分离决策](../../archived/simplification/2026-08-12-separate-source-launch-from-build.md)规定。CJS 钩子保持关闭，因为 CLI（命令行界面）源码图是纯 ESM；实测运行时启动至 TUI banner 耗时约 0.7s，对比完整 tsx 默认形态约 1.1s、已移除的原生链约 0.75s。
+`dsh` CLI（命令行界面）源码启动运行 `node --import tsx/esm`：由 tsx 的 ESM-only 钩子同时负责 TypeScript 转换与 tsconfig `paths` 投影。根目录的 `dsh` 脚本直接从仓库根目录使用同一启动方式；产物生成是独立操作，由[源码启动与构建分离决策](../../archived/simplification/2026-08-12-separate-source-launch-from-build.md)规定。CJS 钩子保持关闭，因为 CLI 源码图是纯 ESM；实现时测得启动至 TUI banner 耗时约 0.7s，对比完整 tsx 默认形态约 1.1s、已移除的原生链约 0.75s。
 
-`scripts/tspath-loader.ts` 与 `apps/cli/src/tsconfig-paths-loader.ts` 已删除。随之消失的还有该 loader「仅为已声明运行时依赖映射 workspace import」的运行时规则——tsx 无条件应用 `paths` 映射。声明完整性现在仅由静态门禁保障：配置的裸插件走 `verify-cordis-config`，manifest（元数据清单）走 workspace constraints。（该运行时规则确实发现过真实缺陷：`dsh-plan-mode` 与 `dsh-tool-jobs` 导入 `@deepseek-ai/dsh-llm` 却只声明在 devDependencies；后已修复。）
+tsx 负责 workspace `paths` 映射，不检查导入方是否把每个包声明为运行时依赖。声明完整性由静态门禁保障：配置的裸插件走 `verify-cordis-config`，manifest（元数据清单）走 workspace constraints。已移除的仓库自有 paths loader 曾在运行时强制这些声明，并发现过将 `@deepseek-ai/dsh-llm` 仅声明在 devDependencies 中的 import；tsx 不提供这项检查。
 
-node-compat CI 矩阵（Node 22.19 与 26）新增 `dsh-source-launch-smoke`（`apps/cli/tests/source-launch.compat.spec.ts`）：以精确的生产运行时启动向量做 keyless 管道 stdio 启动，断言进程会因 TTY 拒绝而以非零状态退出。未来 Node 对模块钩子或 TypeScript 处理的任何改动都会让该门禁变红，而不是破坏开发者的 `pnpm dsh`。
+导入方 URL 含有 `/node_modules/` 时，tsx 会跳过 paths 映射。因此，[runtime resolution](2026-09-09-profile-resolution-generations.zh.md)记录声明包的真实锚点，也覆盖递归依赖。这让 workspace fallback import 一致解析到 `src/`，避免混用构建后的 `lib/` 提供方与模块本地 Symbol 不同的源码调用方。没有 workspace 映射的包仍使用普通导出解析。
+
+node-compat CI 矩阵在不执行 build 的情况下运行 `dsh-source-launch-smoke`（`apps/cli/tests/source-launch.compat.spec.ts`）：无密钥启动断言必需 profile 的诊断，以及不混用 Tools/AgentLoop `src/` 与 `lib/` 实例的 profile 依赖解析。源码与构建入口测试共享普通目录和 npm-link profile 用例；后者通过普通 Node 加载构建后的导出。必跑的 build-backed smoke 还运行 `apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts`：在 native addon 和生成的 typert 贡献文件就绪后，通过 tsx 检查真实 headless 工具派发，同时仍要求核心 workspace 模块从源码加载。模块钩子或 TypeScript 处理的后续变化由这些真实入口检查。
 
 ## 备选方案
 
@@ -35,4 +37,4 @@ node-compat CI 矩阵（Node 22.19 与 26）新增 `dsh-source-launch-smoke`（`
 - 整个 engines 范围（包括未来改变原生 TypeScript 支持的 Node 版本线）只有一个启动向量；冒烟门禁按矩阵行强制执行。
 - TypeScript 转换重新委托给 tsx/esbuild，逆转了前一篇 Agent Note「证明 Node 原生转换可用」的目标；在 vendor 源码使用不可擦除语法且 Node 不再提供 transform 模式的情况下，该目标不可达。
 - 源码启动中的运行时依赖声明强制不复存在；未声明的 workspace import 现在只能通过静态门禁或构建模式的解析失败暴露。
-- 运行时启动相比完整 tsx 默认形态快约 0.4s；ACP（Agent Client Protocol）保留 `--import tsx`，因为它的依赖图尚未就 CJS 钩子依赖性做审计，且其启动延迟不在交互路径上。
+- 每个 CLI 源码 profile 都使用相同的 ESM-only 钩子，包括 ACP（Agent Client Protocol）。该启动方式访问的 workspace 运行时入口必须提供 ESM 导出；启动器不安装 CJS TypeScript 转换钩子。
diff --git a/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.i18n.yaml b/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.i18n.yaml
index 4ebcbc33d9..c58f37c2b3 100644
--- a/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md
-2026-08-05-profile-plugin-bundles.md: 48786a9c1ccaceb5f16c9eefed01e556cf759e6d
-2026-08-05-profile-plugin-bundles.zh.md: c88cbf98e4276549a6fae6a5b1253d3d838a64ca
+2026-08-05-profile-plugin-bundles.md: 0607f1c9a2414cc16515967b4520da8a325853fd
+2026-08-05-profile-plugin-bundles.zh.md: 9d25d3bea6337c472d161c721e44a66dca8470c9
diff --git a/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md b/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md
index 48786a9c1c..0607f1c9a2 100644
--- a/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md
+++ b/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md
@@ -14,14 +14,14 @@ Everything becomes a **profile**: a directory `$DSH_HOME/profiles/<name>` with a
 
 The default Profile templates use `@deepseek-ai/dsh-base` as the shared core for `web`, `headless`, `sdk`, and `acp`, with one mode bundle above it. The [standalone `sdk-minimal` profile](../../../../packages/bundle/sdk-minimal/README.md) instead lists one bundle that owns its complete explicit tree. Generic `dsh --profile <name>` hands its remaining arguments to that profile's command-line startup row: Web owns its flag family, headless owns its task positional, and the protocol profiles accept no app options. Patch overlays use launcher-owned `--patch`. A new, non-shipped target can use `--from-default-profile <template>` to copy one default template's bundle list and patch-reload policy before boot or config dump. This creates an independent profile with empty dependencies and an empty user patch: it neither reads a local profile named by the template nor records an inheritance relationship. The launcher claims the complete target directory exclusively, so existing state and concurrent creators fail without modification. `dsh plugin --profile <name> <args...>` is a thin pnpm forwarder that initializes a base-backed profile and reconciles `dsh.profile.bundles` with installed bundle declarations; a package without a bundle declaration remains a plain dependency. [Headless as a direct core entry point](../../archived/architecture/2026-08-09-headless-direct-core-entry-point.md) owns the headless composition contract.
 
-Resolution is two-anchored by construction: `dsh.profile.bundles` names resolve from the dsh installation first, then the profile directory, so in-box bundles always come from the same installation as the running `dsh` and pnpm never manages them. Bare plugin names in patch rows use the [immutable profile resolution generation](2026-09-09-profile-resolution-generations.md), which applies the same installation-first and ordered-bundle rules in memory; retained link and dual modes can materialize the same result.
+Resolution is two-anchored by construction: `dsh.profile.bundles` names resolve from the dsh installation first, then the profile directory, so in-box bundles always come from the same installation as the running `dsh` and pnpm never manages them. Bare plugin names in patch rows use the [immutable runtime resolution](2026-09-09-profile-resolution-generations.md), which applies installation-first and ordered-bundle rules in memory and expands dependencies from real package directories.
 
 Two supporting refactors: the webserver's built-in static dist serving became the single-owner **fallback seat** (`registerFallback`/`applyIndexTaps`), with the SPA server extracted to `@deepseek-ai/dsh-host-frontend-static` so the web bundle owns its dist as composition, not launcher code; and the personal-overlay machinery of the [dsh CLI personal-config decision](../../archived/feature/2026-07-20-dsh-cli-personal-config.md) (`loadPersonalPatches`, `$DSH_HOME/config.yaml`) was retargeted to the per-profile and home-level `cordis.patch.yml` layers (`loadOptionalPatches`, `watchUserPatches` taking a filename), superseding that note's entry modes and file location while keeping its Harness-home root, patch semantics, and fail-loud parsing.
 
 ## Alternatives considered
 
 - **Dependency-scan plus partial `patchOrder`** (the original sketch): scanning `dependencies` for bundles and ordering unlisted ones alphabetically has two sources of truth and an implicit tie-break; one explicit ordered `dsh.profile.bundles` list is smaller and fully deterministic. A raw `pnpm add` inside the profile installs a library without activating any patch — explicit, no spooky scan.
-- **`link:` entries for in-box bundles**: pnpm cannot version, install, or update a `link:` into the installation, it embeds a machine path in a user file, and it breaks when the installation moves. The two-anchor resolution plus healed symlink fallback gives the same guarantee ("bundles come from the installation") without ceremony.
+- **`link:` entries for in-box bundles**: pnpm cannot version, install, or update a `link:` into the installation, it embeds a machine path in a user file, and it breaks when the installation moves. Two-anchor resolution plus runtime fallback keeps bundles installation-owned without persisting those links.
 - **A pre-boot `context` module in the bundle manifest** for boot-time values (dist path, flag facts): rejected in favor of pure plugins — the glue is ordinary rows and app-owned startup services, so the composition stays fully dumpable and the manifest stays data-only. The launcher-provided host slots (`ctx.cmdlineArgs`, `ctx.appExit`, and the environment snapshot) are provided in `boot()`'s `prepare` hook, before any config-tree entry mounts.
 - **Transitive bundle auto-application**: only direct `dsh.profile.bundles` entries contribute layers; a meta-bundle wanting to re-export another bundle's patch must do so explicitly in its own patch file.
 - **Dynamic template inheritance or cloning a local profile**: recording a parent would require merge and upgrade rules for bundle membership, dependencies, and user patches, while copying local state would duplicate machine-specific choices. Template-based creation copies only installation-owned defaults once.
diff --git a/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.zh.md b/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.zh.md
index c88cbf98e4..9d25d3bea6 100644
--- a/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.zh.md
+++ b/.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.zh.md
@@ -14,14 +14,14 @@ Status: implemented
 
 默认 Profile 模板为 `web`、`headless`、`sdk` 与 `acp` 使用 `@deepseek-ai/dsh-base` 作为共享核心，并在其上叠加一个模式组合包。[独立 `sdk-minimal` profile](../../../../packages/bundle/sdk-minimal/README.zh.md)则只列出一个拥有完整显式配置树的组合包。通用的 `dsh --profile <name>` 把剩余参数交给该 profile 的命令行启动行：Web 持有自己的 flag 家族，headless 持有任务位置参数，协议 profile 不接受应用选项。patch overlay 使用启动器持有的 `--patch`。新的非内置目标可以使用 `--from-default-profile <template>`，在启动或配置 dump 之前复制一个默认模板的 bundle 列表与 patch 重载策略。这会创建依赖为空、用户 patch 为空的独立 profile：它既不读取与模板同名的本地 profile，也不记录继承关系。launcher 会以独占方式领取完整的目标目录，因此既有状态和并发创建者都会在不作修改的情况下失败。`dsh plugin --profile <name> <args...>` 是一层薄薄的 pnpm 转发器，负责初始化一个以 base 为基础的 profile，并依据已安装包的组合包声明调和 `dsh.profile.bundles`；没有组合包声明的包保持为普通依赖。[Headless 作为直接 core 入口](../../archived/architecture/2026-08-09-headless-direct-core-entry-point.md)负责 headless 组合约定。
 
-解析在构造上就是双锚点的：`dsh.profile.bundles` 中的名称先从 dsh 安装目录解析，再从 profile 目录解析，因此内置组合包始终来自与运行中 `dsh` 相同的安装，pnpm 从不管理它们。patch 行中的裸插件名称使用[不可变 profile resolution generation](2026-09-09-profile-resolution-generations.zh.md)，在内存中应用相同的安装优先与有序 bundle 规则；保留的 link 与 dual 模式可以物化同一结果。
+解析在构造上就是双锚点的：`dsh.profile.bundles` 中的名称先从 dsh 安装目录解析，再从 profile 目录解析，因此内置组合包始终来自与运行中 `dsh` 相同的安装，pnpm 从不管理它们。patch 行中的裸插件名称使用[不可变 runtime resolution](2026-09-09-profile-resolution-generations.zh.md)，在内存中应用安装优先与有序 bundle 规则，并从包的真实目录展开依赖。
 
 两项配套重构：webserver 内置的静态 dist 服务改为单一所有者的**回退席位**（`registerFallback`／`applyIndexTaps`），SPA 服务器提取到 `@deepseek-ai/dsh-host-frontend-static`，使 web 组合包以组合的方式持有自己的 dist，而不是靠启动器代码；[dsh CLI 个人配置决策](../../archived/feature/2026-07-20-dsh-cli-personal-config.md)的个人 overlay 机制（`loadPersonalPatches`、`$DSH_HOME/config.yaml`）改为面向逐 profile 与 home 级的 `cordis.patch.yml` 层（`loadOptionalPatches`、接受文件名的 `watchUserPatches`），取代该笔记的各入口模式与文件位置，同时保留其 Harness home 根目录、patch 语义与响亮失败的解析。
 
 ## Alternatives considered
 
 - **依赖扫描加部分 `patchOrder`**（最初的草案）：扫描 `dependencies` 找出组合包、未列出者按字母序排列，会产生两个真源和一条隐式决胜规则；一份显式有序的 `dsh.profile.bundles` 列表更小、完全确定。在 profile 内直接 `pnpm add` 只会安装一个库，不激活任何 patch——行为显式，没有暗中扫描。
-- **内置组合包使用 `link:` 条目**：pnpm 无法对指向安装目录的 `link:` 做版本管理、安装或更新，它会把机器路径嵌进用户文件，并且在安装目录移动后失效。双锚点解析加上每次启动修复的符号链接回退提供了同样的保证（「组合包来自安装目录」），且没有这些繁文缛节。
+- **内置组合包使用 `link:` 条目**：pnpm 无法对指向安装目录的 `link:` 做版本管理、安装或更新，它会把机器路径嵌进用户文件，并且在安装目录移动后失效。双锚点解析加运行时 fallback 可以让组合包保持由安装持有，无需持久化这些链接。
 - **在组合包 manifest 中放一个启动前 `context` 模块**承载启动期取值（dist 路径、flag 事实）：否决，改用纯插件——粘合逻辑就是普通配置行和由应用持有的启动服务，因此组合始终可完整 dump，manifest 保持纯数据。启动器提供的宿主 slot（`ctx.cmdlineArgs`、`ctx.appExit` 与环境快照）在任何配置树条目挂载之前，于 `boot()` 的 `prepare` 钩子中提供。
 - **组合包的传递式自动应用**：只有直接列在 `dsh.profile.bundles` 中的条目才贡献层；想重新导出另一个组合包 patch 的元组合包，必须在自己的 patch 文件中显式完成。
 - **动态模板继承或克隆本地 profile**：记录父级会要求为 bundle 成员关系、依赖和用户 patch 制定合并与升级规则，而复制本地状态会重复机器特定选择。基于模板的创建只会一次性复制安装自有的默认值。
diff --git a/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.i18n.yaml b/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.i18n.yaml
index b3d68505df..8a7e75ad27 100644
--- a/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.md
-2026-08-18-experimental-agent-teams-packages.md: a1d29b5e96b185a5539d664e19f2f5cc342a6aba
-2026-08-18-experimental-agent-teams-packages.zh.md: f4c4eb481ae6ad6319ddac50eda82fa9b9feebf7
+2026-08-18-experimental-agent-teams-packages.md: 92eba148b328135301b196c9a17e49ee23ddb3f6
+2026-08-18-experimental-agent-teams-packages.zh.md: 6f4d004a78e32e2c27ad65648c446b3cd54c07ad
diff --git a/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.md b/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.md
index a1d29b5e96..92eba148b3 100644
--- a/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.md
+++ b/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.md
@@ -20,7 +20,7 @@ The generic caller-reserved continuable child identity and selective direct-chil
 
 The [single-bundle decision](2026-09-18-agent-teams-single-bundle.md) supersedes the separate Host and Web bundle composition. This note retains publication, dependency isolation, and promotion rationale. The current Team profile remains opt-in and disables the global continuable-child controls whose model-visible names overlap the Team tools; the [optional-bundle decision](../process/2026-09-15-shipped-optional-bundles.md) owns its inclusion in the installation.
 
-Profile startup resolves selected bundles before computing the [immutable profile resolution generation](2026-09-09-profile-resolution-generations.md). The generation retains installation-first precedence, traverses each explicit bundle root completely in profile order, and keeps pnpm-managed profile packages authoritative. Runtime mode enforces the result in memory; retained link and dual modes materialize the same result as shared and profile-owned projections. A private profile layer can therefore carry experimental plugin rows without adding those plugins to a release app, requiring profile users to install transitive packages directly, weakening packaged-runtime module identity, or changing another profile's resolution.
+Profile startup resolves selected bundles before computing the [immutable runtime resolution](2026-09-09-profile-resolution-generations.md). The runtime resolution retains installation-first precedence, traverses each explicit bundle root completely in profile order, and keeps pnpm-managed profile packages authoritative. The runtime interception enforces the result in memory without materializing fallback links. A private profile layer can therefore carry experimental plugin rows without adding those plugins to a release app, requiring profile users to install transitive packages directly, weakening packaged-runtime module identity, or changing another profile's resolution.
 
 Experimental status changes compatibility and support expectations, not publication for these four packages. They retain the repository's ordinary documentation, invariant, lifecycle, security, unit, real-composition, and snapshot requirements. Promotion still requires review of the public contracts, limitations, test evidence, runtime dependents, and a named owner accepting stable-package obligations.
 
diff --git a/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.zh.md b/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.zh.md
index f4c4eb481a..6f4d004a78 100644
--- a/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.zh.md
+++ b/.agents/notes/implemented/architecture/2026-08-18-experimental-agent-teams-packages.zh.md
@@ -20,7 +20,7 @@ dsh 打包与发布集合以及本地基线发布器包含这四个 Agent Teams
 
 [单组合包决策](2026-09-18-agent-teams-single-bundle.zh.md)取代了独立 Host 与 Web 组合包的组合方式。本记录保留发布、依赖隔离与 promotion 的理由。当前 Team profile 仍须显式启用，并禁用模型可见名称与 Team 工具重叠的全局 continuable-child control；[可选组合包决策](../process/2026-09-15-shipped-optional-bundles.zh.md)负责其随安装交付的规则。
 
-profile 启动会先解析所选 bundle，再计算[不可变 profile resolution generation](2026-09-09-profile-resolution-generations.zh.md)。generation 保留安装优先顺序，按 profile 顺序完整遍历每个显式 bundle 根，并让 pnpm 管理的 profile 包保持优先。runtime 模式在内存中强制该结果；保留的 link 与 dual 模式把同一结果物化为共享和 profile 自有投影。因此，私有 profile 层可以携带实验性 plugin 配置行，而无需把这些 plugin 加入发布 app、要求 profile 用户直接安装传递依赖、破坏 packaged-runtime 的模块身份，或改变其他 profile 的解析结果。
+profile 启动会先解析所选 bundle，再计算[不可变 runtime resolution](2026-09-09-profile-resolution-generations.zh.md)。runtime resolution 保留安装优先顺序，按 profile 顺序完整遍历每个显式 bundle 根，并让 pnpm 管理的 profile 包保持优先。运行时拦截在内存中强制该结果，不物化 fallback 链接。因此，私有 profile 层可以携带实验性 plugin 配置行，而无需把这些 plugin 加入发布 app、要求 profile 用户直接安装传递依赖、破坏 packaged-runtime 的模块身份，或改变其他 profile 的解析结果。
 
 对这四个包而言，实验性状态改变兼容性与支持预期，而不阻止发布。这些包仍须满足仓库的一般文档、不变式、生命周期、安全、单元测试、真实组合测试和快照要求。promotion 前仍须评审公开约定、限制、测试证据、运行时依赖方，并由一名具名 owner 接受稳定包义务。
 
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml
index 62c5aa6ad8..552cf1b424 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
-2026-09-08-desktop-bundled-runtime-and-external-plugins.md: a5f9266e0e7a8def3f0ff6fc271bddde3db30163
-2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md: 2cc9fd635102f08e6ca4afb4f086a0cf6b8b05f0
+2026-09-08-desktop-bundled-runtime-and-external-plugins.md: 61fa9eafb72133d4cbba1b65193275cc8474f7e5
+2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md: 8d94d5823526ab4e615dab13f8453c8b6da5d8b6
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
index a5f9266e0e..61fa9eafb7 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md
@@ -28,17 +28,17 @@ The [Desktop file policy](../../../../apps/desktop/scripts/runtime-file-policy.t
 
 Package-specific exclusions remove Domino tests, fs-ext compilation outputs, Koffi's Windows import library, and non-target node-pty prebuilds and debug symbols. The policy retains native executable dependencies, node-pty's ConPTY source distribution, licenses, and unrecognized assets; broad `src`, `test`, `.ts`, or `.map` exclusions could remove executable code or runtime data. Copy tests preserve sentinel assets and seal the filtered inventory; the Electron [payload smoke](../../../../apps/desktop/tests/fixtures/runtime-payload-smoke.mjs) verifies PTY output, native file seeking, FFI, image conversion, and HTML parsing. Runtime preparation still verifies every retained byte and boots the complete Host with an external plugin.
 
-The shared profile runner projects missing installation and selected-bundle dependencies within the Desktop profile. pnpm-installed packages take precedence. Links resolve to real package directories under normal Node resolution, so Host and plugin imports reaching the same export share its module instance. Distinct ESM and CommonJS conditional exports remain distinct entry points; a link cannot merge a package’s dual implementations.
+The shared profile runner supplies missing installation and selected-bundle dependencies through the runtime resolution. pnpm-installed packages take precedence. Runtime resolution delegates to the selected package paths, so Host and plugin imports reaching the same export share its module instance. Distinct ESM and CommonJS conditional exports remain distinct entry points; runtime resolution does not merge a package’s dual implementations.
 
-External plugins use normal Node package resolution. Desktop does not recursively check peer versions, duplicate packages, linked packages, or ancestor dependency resolution. These checks duplicate package-manager and loader responsibilities and reject pnpm-supported installation sources. Shared fallback links supply missing packages, but a plugin can resolve another installed copy; incompatible plugins may fail during Host startup and require recovery through the independent shell UI.
+External plugins use normal Node package resolution. Desktop does not recursively check peer versions, duplicate packages, linked packages, or ancestor dependency resolution. These checks duplicate package-manager and loader responsibilities and reject pnpm-supported installation sources. The runtime resolution supplies missing packages, but a plugin can resolve another installed copy; incompatible plugins may fail during Host startup and require recovery through the independent shell UI.
 
-The profile manifest records pnpm-installed dependencies separately from its enabled bundle list. Disabling a plugin preserves its package, lockfile entry, and user configuration. The [thin-wrapper decision](2026-09-10-desktop-web-wrapper.md) assigns initialization, bundle reconciliation, and module links to shared app-boot helpers; Desktop holds no separate link ledger or runtime-state identity.
+The profile manifest records pnpm-installed dependencies separately from its enabled bundle list. Disabling a plugin preserves its package, lockfile entry, and user configuration. The [thin-wrapper decision](2026-09-10-desktop-web-wrapper.md) assigns initialization, bundle reconciliation, and runtime module resolution to shared app-boot helpers; Desktop holds no separate link ledger or runtime-state identity.
 
 ## Transactions and upgrades
 
-First launch creates profile metadata and host links without running pnpm, preserving unrelated files. Compatible release changes or application relocation refresh links in place. Node version, platform, or architecture changes preserve installed plugins; pnpm and the loader report installation and compatibility failures.
+First launch creates profile metadata without running pnpm, preserving unrelated files. Each launch computes the runtime resolution from the current installation, including after a compatible release change or application relocation. Node version, platform, or architecture changes preserve installed plugins; pnpm and the loader report installation and compatibility failures.
 
-Native canonical paths identify shared package directories. Windows launchers can vary path casing without moving the application; string equality would trigger unnecessary profile preparation. Profile cleanup explicitly unlinks every nested directory link before removing real directories. A Windows fixture under Electron 44 reproduces recursive `fs.rmSync` deleting files through a nested junction, while bundled upstream Node 24.17 preserves them. Cleanup qualification therefore includes the real Electron runtime; Node-only tests do not establish target preservation.
+Native canonical paths identify shared package directories. Windows launchers can vary path casing without moving the application; string equality would trigger unnecessary profile preparation.
 
 The shared [plugin manager](../../../../packages/boot/plugin-manager/README.md) owns supported package specifications, bundle validation, activation, and installation failure handling. The bundled pnpm reads normal user and profile settings. Development uses the same Web manager against a separate Desktop profile, with workspace packages supplied by the development runtime.
 
@@ -51,9 +51,9 @@ The [immediate-window decision](2026-09-09-desktop-immediate-window-and-direct-s
 Full runtime verification belongs to packaging. Startup reads the resource descriptor and checks shared package records and required Host entries. The [release-validation decision](2026-09-09-desktop-build-release-validation.md) assigns release and target compatibility checks to packaging. Startup neither enumerates nor hashes installed runtime files. Reading every file before backend loading adds I/O proportional to distribution size; unusable modules instead fail when loaded. Build-time verification rejects changed, missing, extra, or linked files against the recorded inventory.
 
 - **Install the bundled offline seed at startup.** This preserves an ordinary pnpm installation procedure but repeats core extraction and installation on every affected machine. Materialized resources remove that work at the cost of more application files and release-builder responsibility.
-- **Force host dependency versions into plugins.** This unnecessarily couples ordinary plugin dependencies to the host. Shared fallback supplies missing packages while pnpm-owned entries retain independent versions.
-- **Use hardlinks.** They cannot represent directories, may not cross volumes, share writable bytes, and retain old inodes after application replacement. Directory symlinks and Windows junctions express the intended package target.
-- **Use `NODE_PATH` or preserve symlink paths.** These do not provide uniform ESM resolution or shared module identity. Normal package lookup through explicit links is directly testable.
+- **Force host dependency versions into plugins.** This unnecessarily couples ordinary plugin dependencies to the host. The runtime resolution supplies missing packages while pnpm-owned entries retain independent versions.
+- **Use hardlinks.** They cannot represent directories, may not cross volumes, share writable bytes, and retain old inodes after application replacement. Runtime resolution requires no filesystem projections.
+- **Use `NODE_PATH` or preserve symlink paths.** These do not provide uniform ESM resolution or shared module identity. The runtime resolution gives ESM and CommonJS the same package selection.
 - **Keep core packages in ASAR.** Ordinary `extraResources` preserves native loading and subprocess paths. ASAR requires separate package-resolution qualification.
 
 ## Consequences
diff --git a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
index 2cc9fd6351..8d94d58235 100644
--- a/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md
@@ -28,17 +28,17 @@ Desktop 初始化时安装核心依赖图，会重复发布构建器已经完成
 
 包专用排除项包括 Domino 测试、fs-ext 编译产物、Koffi 的 Windows 导入库，以及非目标平台的 node-pty 预构建文件和调试符号。规则保留原生可执行依赖、node-pty 的 ConPTY 源分发内容、许可证和未知资源；宽泛排除 `src`、`test`、`.ts` 或 `.map` 可能移除可执行代码或运行时数据。复制测试保留哨兵资源并封存过滤后的清单；Electron 的[产物 smoke](../../../../apps/desktop/tests/fixtures/runtime-payload-smoke.mjs)验证 PTY 输出、原生文件定位、FFI、图像转换和 HTML 解析。运行时准备仍会验证每个保留字节，并携带外部插件启动完整 Host。
 
-共享 profile runner 在 Desktop profile 内补全安装包与选中 bundle 缺失的依赖。pnpm 安装的包优先。链接通过正常 Node 解析指向真实包目录，因此 Host 与插件导入同一导出时共享其模块实例。不同的 ESM 与 CommonJS 条件导出仍是不同入口；链接不能合并包的双重实现。
+共享 profile runner 通过 runtime resolution 补全安装包与选中 bundle 缺失的依赖。pnpm 安装的包优先。运行时解析委托给所选包路径，因此 Host 与插件导入同一导出时共享其模块实例。不同的 ESM 与 CommonJS 条件导出仍是不同入口；运行时解析不会合并包的双重实现。
 
-外部插件使用正常 Node 包解析。Desktop 不递归检查 peer 版本、重复包、链接包或上级目录依赖解析。这些检查重复包管理器及加载器的职责，并拒绝 pnpm 支持的安装来源。共享补全链接提供缺失的包，但插件可以解析到另一份已安装副本；不兼容插件可能在 Host 启动时失败，需要通过独立壳 UI 恢复。
+外部插件使用正常 Node 包解析。Desktop 不递归检查 peer 版本、重复包、链接包或上级目录依赖解析。这些检查重复包管理器及加载器的职责，并拒绝 pnpm 支持的安装来源。runtime resolution 提供缺失的包，但插件可以解析到另一份已安装副本；不兼容插件可能在 Host 启动时失败，需要通过独立壳 UI 恢复。
 
-profile manifest 分别记录 pnpm 安装的依赖及已启用 bundle 列表。禁用插件保留其包、锁文件条目及用户配置。[薄壳决策](2026-09-10-desktop-web-wrapper.zh.md)将初始化、bundle 协调和模块链接交给共享 app-boot helper；Desktop 不保存独立链接账本或运行时状态身份。
+profile manifest 分别记录 pnpm 安装的依赖及已启用 bundle 列表。禁用插件保留其包、锁文件条目及用户配置。[薄壳决策](2026-09-10-desktop-web-wrapper.zh.md)将初始化、bundle 协调和运行时模块解析交给共享 app-boot helper；Desktop 不保存独立链接账本或运行时状态身份。
 
 ## 事务与升级
 
-首次启动创建 profile 元数据和宿主链接，不运行 pnpm，并保留无关文件。兼容的发布变化或应用移动会直接刷新链接。Node 版本、平台或架构变化时保留已安装插件；安装和兼容性错误由 pnpm 与加载器报告。
+首次启动创建 profile 元数据，不运行 pnpm，并保留无关文件。每次启动都从当前安装计算 runtime resolution，包括兼容的发布变化或应用移动之后。Node 版本、平台或架构变化时保留已安装插件；安装和兼容性错误由 pnpm 与加载器报告。
 
-共享包目录使用原生规范路径识别。Windows 启动器可能改变路径大小写而不移动应用；字符串相等判断会触发不必要的 profile 准备。profile 清理在移除真实目录前，显式解除每一个嵌套目录链接。Windows 夹具在 Electron 44 下复现了递归 `fs.rmSync` 沿嵌套 junction 删除目标文件，而内置上游 Node 24.17 会保留它们。因此清理验收包含真实 Electron 运行时；仅在 Node 下测试不能证明目标文件会保留。
+共享包目录使用原生规范路径识别。Windows 启动器可能改变路径大小写而不移动应用；字符串相等判断会触发不必要的 profile 准备。
 
 共享[插件管理器](../../../../packages/boot/plugin-manager/README.zh.md)负责支持的包规格、bundle 验证、激活和安装失败处理。内置 pnpm 读取正常的用户和 profile 设置。开发模式使用相同的 Web 管理器操作独立 Desktop profile，工作区包由开发运行时提供。
 
@@ -51,9 +51,9 @@ profile manifest 分别记录 pnpm 安装的依赖及已启用 bundle 列表。
 完整运行时验证属于打包流程。启动读取资源描述文件，并检查共享包记录及必要的 Host 入口。[发布验证决策](2026-09-09-desktop-build-release-validation.zh.md)将发布与目标兼容性检查交给打包流程。启动既不枚举已安装运行时文件，也不计算其哈希。后端加载前读取每个文件会增加与分发体积成正比的 I/O；不可用模块改由加载时失败暴露。构建时验证按记录清单拒绝内容变化、缺失、多余或链接文件。
 
 - **启动时安装内置离线 seed。** 这保留普通 pnpm 安装流程，但会在每台受影响机器上重复核心解压与安装。物化资源消除了这部分工作，代价是更多应用文件和发布构建器责任。
-- **强制插件使用 Host 依赖版本。** 这会让普通插件依赖不必要地耦合于 Host。共享模块补全提供缺失的包，pnpm 拥有的条目保留独立版本。
-- **使用硬链接。** 它不能表示目录，可能无法跨卷，共享可写字节，并在应用替换后保留旧 inode。目录软链接和 Windows junction 能表达预期的包目标。
-- **使用 `NODE_PATH` 或保留软链接路径。** 它们不能提供统一的 ESM 解析或共享模块身份。通过明确链接进行正常包查找可以直接测试。
+- **强制插件使用 Host 依赖版本。** 这会让普通插件依赖不必要地耦合于 Host。runtime resolution 提供缺失的包，pnpm 拥有的条目保留独立版本。
+- **使用硬链接。** 它不能表示目录，可能无法跨卷，共享可写字节，并在应用替换后保留旧 inode。运行时解析不需要文件系统投影。
+- **使用 `NODE_PATH` 或保留软链接路径。** 它们不能提供统一的 ESM 解析或共享模块身份。runtime resolution 为 ESM 与 CommonJS 提供相同的选包结果。
 - **把核心包留在 ASAR。** 普通 `extraResources` 保留原生加载和子进程路径。ASAR 需要单独验证包解析。
 
 ## 影响
diff --git a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml
index 00fcdb4e39..4954b13269 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
-2026-09-09-profile-resolution-generations.md: f33f7012a15b27a8fac4c4d44f19be3046ec5572
-2026-09-09-profile-resolution-generations.zh.md: 4a25386d99e95d6b00e822b60cdb2c6e094b4693
+2026-09-09-profile-resolution-generations.md: 1a83955b9c79458c31b8aff78eb05a2235f544e8
+2026-09-09-profile-resolution-generations.zh.md: d634ac9119bc5c0110077451c03086ee5d1fffb8
diff --git a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
index f33f7012a1..1a83955b9c 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md
@@ -8,29 +8,67 @@ English | [中文](2026-09-09-profile-resolution-generations.zh.md)
 
 A profile loads plugin rows from its own package project, while Harness packages and packages carried by selected bundles can live outside that project's ordinary dependency tree. Bridging the trees through shared symlinks, profile-owned links, or packaged-executable proxy packages persists package selections across processes and installations. Those files require reconciliation and locking, expose generated proxy manifests to metadata readers, and cannot represent a process-local change atomically.
 
-The runtime design preserves the existing selection rules rather than introducing a second package policy. It covers imports performed by plugin modules as well as Loader row imports and works in the main thread and Harness-owned Workers. Generation replacement accepts only additive package sets and never mutates a live table entry by entry.
+The runtime design keeps installation-first, ordered-bundle, and local-before-fallback precedence. It covers imports performed by plugin modules as well as Loader row imports and works in the main thread and Harness-owned Workers. Generation replacement accepts only additive package sets and never mutates a live table entry by entry.
 
 ## Decision
 
-Profile startup computes one immutable `ResolutionGeneration` from the same dependency traversal that supplies the disk module fallback. The launcher defaults to runtime mode, which installs the generation into Node's ESM and CommonJS resolvers without materializing fallback links. Plain Node callers and tests can explicitly select link mode to materialize the generation or dual mode to materialize and verify it. `PluginPackages.replace()` publishes a complete additive successor with one reference replacement.
+Profile startup computes one immutable `RuntimeResolution` and installs it into Node's ESM and CommonJS resolvers. Runtime is the only resolution backend; there is no mode selector or disk materializer. `PluginPackages.replace()` publishes a complete additive successor with one reference replacement.
 
 The TypeScript CLI entry explicitly selects link mode. Its tsx workspace imports and profile plugins must share module URLs; combining `src/index.ts` and `lib/index.js` creates distinct private Symbols and service identities. The built CLI keeps runtime mode, and explicit `runProfile` resolution overrides remain available.
 
 ### One selection algorithm
 
-The package traversal remains in `@deepseek-ai/dsh-app-boot` beside profile loading. The disk materializer and the runtime resolver consume one pure plan; neither owns a copy of the precedence algorithm. Ordinary Node callers can select link, dual, or runtime mode, while an omitted mode selects runtime. Packaged executables and the Electron Host select runtime mode because their dependency trees may live in a virtual filesystem; dual remains an internal comparison path.
+The package traversal belongs to `@deepseek-ai/dsh-app-boot` beside profile loading. Ordinary Node, source launches, packaged executables, and the Electron Host consume the same runtime resolution and interception.
 
-The installation manifest is the first root. Its graph traverses `dependencies` followed by `peerDependencies` breadth-first, resolving each edge from the manifest that declares it. The first installed package reached under a name owns that name. Selected bundle roots then run in profile order, with each earlier root's complete graph taking precedence over every later root. Names supplied by the installation are reserved, and bundle package roots themselves do not become plugin fallbacks. Missing declared packages are skipped as before.
+The installation manifest is the first root. Its graph traverses `dependencies` followed by `peerDependencies` breadth-first, resolving each edge from the manifest that declares it. The first installed package reached under a name owns that name. Selected bundle roots then run in profile order, with each earlier root's complete graph taking precedence over every later root. Names supplied by the installation are reserved, and bundle package roots themselves do not become plugin fallbacks. Missing declared packages are skipped.
 
-Profile-local and plugin-private `node_modules` entries stay outside the fallback entries, and Node checks them before the virtual fallback position. The generation records only installed direct profile package names for a no-I/O native fast path. Each fallback entry records the package name, version, selected lookup directory, declaring manifest anchor, and scope needed to rerun Node's native resolution from the selected package and validate that a successor preserves existing mappings.
+During dependency expansion, every installation root, selected bundle root, and recursive dependency manifest uses its package's real directory as the lookup anchor. Ancestor `node_modules` searches therefore follow the location from which Node normally executes the package, not the location of a symlink pointing to it. The same declaring anchor is recorded for runtime delegation. This can change the selected version or remove an otherwise discoverable dependency when logical and real ancestors differ; it is not merely a spelling change to stored paths.
 
-The existing `healProfilesModuleFallback()` remains as the disk materializer for the same computed result, which permits direct comparison without rewriting the selection rules. Named profile launches use it only in explicit link or dual mode. Runtime mode computes the generation without materializing it, while dual mode materializes and installs that generation for comparison.
+Profile-local and plugin-private `node_modules` entries take precedence over runtime resolution entries. The runtime resolution records installed direct profile package names for a no-I/O native fast path. Each entry records the package name, version, selected lookup directory, declaring manifest anchor, and scope needed for native resolution and successor validation.
+
+The profile-scope entries of the runtime resolution remain necessary for dependencies that the profile cannot find through its own ancestor directories. They expand installed manifest dependencies into the active profile's runtime resolution, not a separate graph for each plugin. It neither downloads packages nor scans source imports. Runtime hooks consume that table after native local candidates have been considered.
+
+### Ordinary and linked package examples
+
+In both layouts below, the profile selects `my-bundle`, whose manifest declares `bridge`; only `bridge` declares `leaf`. Neither the installation nor the profile's direct packages supplies `leaf`, and `bridge` has no private `node_modules/leaf`. The paths illustrate the two layouts exercised by the [shared CLI profile tests](../../../../apps/cli/tests/profiles/headless/tests/profile-resolution.ts).
+
+With ordinary installed directories, `bridge` searches its containing bundle's `node_modules` and finds version 1.0.0. The unrelated version 2.0.0 is not on that search path:
+
+```text
+/case/home/profiles/headless/node_modules/my-bundle/
+  node_modules/bridge/
+  node_modules/leaf/                                  # 1.0.0
+/case/dependencies/node_modules/leaf/                 # 2.0.0
+```
+
+With an npm-link-style bundle and a linked transitive dependency, the bundle expands from `/case/work/my-bundle`, and the next dependency expansion starts at `/case/dependencies/bridge`. That expansion finds version 2.0.0 beside the real package:
+
+```text
+/case/home/profiles/headless/node_modules/my-bundle -> /case/npm-global/node_modules/my-bundle
+/case/npm-global/node_modules/my-bundle -> /case/work/my-bundle
+/case/work/my-bundle/node_modules/bridge -> /case/dependencies/bridge
+/case/work/my-bundle/node_modules/leaf/                # 1.0.0
+/case/dependencies/node_modules/leaf/                 # 2.0.0
+```
+
+| Profile package layout | Declaring directory used to resolve `leaf` | `tsx/esm` source launch | Plain Node `lib` launch |
+|---|---|---|---|
+| Ordinary directories | `/case/home/profiles/headless/node_modules/my-bundle/node_modules/bridge` | 1.0.0 | 1.0.0 |
+| Linked bundle and bridge | `/case/dependencies/bridge` | 2.0.0 | 2.0.0 |
+
+ESM `import` and CommonJS `require` select these versions. Within each module format, importing `leaf` through profile fallback and importing it inside `bridge` reaches the same module instance. A higher-priority native profile package or an installation-reserved fallback name still wins according to the selection rules; the fallback does not force every importer to use version 2.0.0.
+
+### Source and built module identity
+
+The [source launcher](2026-07-29-dsh-source-launch-tsx-esm.md) uses tsx's ESM-only hook. tsx skips tsconfig `paths` for an importer URL containing `/node_modules/`. A logical workspace symlink used as a fallback declaring anchor can therefore select built `lib/` exports, while imports from the resulting real workspace files select `src/` through the paths map. Real declaring anchors let workspace imports follow the source map consistently; packages without a matching workspace mapping keep ordinary package-export resolution.
+
+For example, `@deepseek-ai/dsh-tools` creates its scheduler key with `Symbol()`. A Tools instance loaded from `lib/` cannot expose that scheduler through a key imported from the separate `src/` module instance. Source launches keep Tools and AgentLoop in `src/`; plain Node launches keep them in `lib/`. The scheduler retains its local Symbol; correct imports share one module instance.
 
 ### Immutable generations
 
-A resolver registration holds one `current` generation. Each synchronous resolution captures that reference once. Generation construction reads every required manifest before publication; an error leaves the current generation unchanged. Successful publication replaces one reference, and in-flight calls may finish against the generation they captured.
+A runtime interception holds one `current` generation. Each synchronous resolution captures that reference once. Generation construction reads every required manifest before publication; an error leaves the current generation unchanged. Successful publication replaces one reference, and in-flight calls may finish against the generation they captured.
 
-Selection and package-metadata caches belong to a generation. Publishing a successor invalidates them by making the old generation unreachable after its callers finish; update code does not mutate or clear individual entries. A generation hit and a successful native selection can be cached, but a generation miss is rescanned so a profile-local package installed after the miss becomes visible as it does in link mode. Calls with explicit CommonJS paths or non-default conditions never reuse a default-resolution cache entry.
+Selection and package-metadata caches belong to a generation. Publishing a successor invalidates them by making the old generation unreachable after its callers finish; update code does not mutate or clear individual entries. A generation hit and a successful native selection can be cached, but a generation miss is rescanned so a profile-local package installed after the miss becomes visible through native lookup. Calls with explicit CommonJS paths or non-default conditions never reuse a default-resolution cache entry.
 
 The launcher constructs one startup generation. The service accepts an additive successor, but no package-manager transaction invokes replacement in this implementation.
 
@@ -38,7 +76,7 @@ The launcher constructs one startup generation. The service accepts an additive
 
 The resolver uses `node-addon-require-builtin` to read `internal/modules/esm/loader` and `internal/modules/cjs/loader`. The ESM adapter wraps the per-thread singleton `CascadedLoader` resolve methods. The CommonJS adapter wraps the internal builtin's `Module._resolveFilename`; that `Module` is the same object exported by `node:module`.
 
-Both adapters call one routing function. It ignores builtins, relative or absolute paths, URLs, parents outside the profile scope, and explicit calls outside the supported lookup. A `#imports` request uses Node's mapping from its owning manifest; an external bare target follows the same local, generation, and after-fallback package order with the request's conditions, while Node retains exact target resolution. For a scoped bare request, a package self-reference keeps the original parent even when an npm alias gives its installed directory another name. A profile-local or plugin-private package also keeps the original parent when Node resolves the requested entry before the virtual shared-fallback position; a CommonJS package directory without `exports` does not suppress the fallback when only its requested subpath is absent. Otherwise the router uses a generation hit through that entry's declaring anchor or continues native lookup after the virtual fallback. Explicit CommonJS path lists apply the same insertion rule independently to each path in caller order.
+Both adapters call one routing function. It ignores builtins, relative or absolute paths, URLs, parents outside the profile scope, and explicit calls outside the supported lookup. A `#imports` request uses Node's mapping from its owning manifest; an external bare target follows the same local, interception, and native-after-interception package order with the request's conditions, while Node retains exact target resolution. For a scoped bare request, a package self-reference keeps the original parent even when an npm alias gives its installed directory another name. A profile-local or plugin-private package also keeps the original parent when Node resolves the requested entry before the virtual shared-fallback position; a CommonJS package directory without `exports` does not suppress the fallback when only its requested subpath is absent. Otherwise the router uses an interception hit through that entry's declaring anchor or continues native lookup after the virtual fallback. Explicit CommonJS path lists apply the same insertion rule independently to each path in caller order.
 
 The adapters call the captured native resolver after routing. Node remains responsible for exports, import and require conditions, main files, subpaths, extensions, native caches, and error codes. Routed ESM failures replace the internal lookup anchor in Node's diagnostic with the original importer. A selected package's invalid export or missing target does not trigger another same-name candidate. CommonJS does not replace `_findPath` or reproduce `_resolveFilename`.
 
@@ -46,11 +84,11 @@ The guarantee covers Node's default `import`, `import()`, `import.meta.resolve`,
 
 ### Active plugin list and package metadata
 
-The resolution generation lists available fallback packages; Loader entries form the active plugin list. Consumers keep using Loader's existing entry lifecycle and filter the entries relevant to their own scope. Consumers that need package metadata pass a specifier and owning tree base URL to a lightweight `app-boot` service without requiring a `./package.json` export. An installed generation is authoritative, including a miss; a service created without a generation retains native lookup for low-level embedders.
+The runtime resolution lists the packages it supplies; Loader entries form the active plugin list. Consumers keep using Loader's existing entry lifecycle and filter the entries relevant to their own scope. Consumers that need package metadata pass a specifier and owning tree base URL to a lightweight `app-boot` service without requiring a `./package.json` export. An installed runtime resolution is authoritative, including a miss; a service created without one retains native lookup for low-level embedders.
 
 The resolver does not expose `imported(entry)` and does not observe ModuleJobs, wrap Entry methods, associate fibers with import calls, replace registry or tree methods, or adapt HMR transactions. A repeated query uses the same generation and therefore cannot drift from the route used for the import. Non-Node importers that need package metadata must explicitly implement the same deterministic resolver interface.
 
-The implementation lives under `app-boot/src/profile-resolution/`. `service.ts` provides the long-lived `ctx.pluginPackages` and owns the main-thread resolver and Worker-generation lifetimes; `resolver.ts` implements generation lookup and the Node Internal adapters; `worker-bootstrap.ts` installs an inherited generation in one thread. Existing profile selection and disk materialization remain in `profile.ts`. Workers reference the bootstrap only through the public `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` export.
+The implementation lives under `app-boot/src/profile-resolution/`. `service.ts` provides the long-lived `ctx.pluginPackages` and owns the main-thread interception and the Worker resolution lifetime; `resolver.ts` implements runtime resolution lookup and the Node Internal adapters; `worker-bootstrap.ts` installs the inherited runtime resolution in one thread. Profile selection and runtime resolution construction remain in `profile.ts`. Workers reference the bootstrap only through the public `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` export.
 
 The service definition and provider remain together in `app-boot` because profile boot owns the resolver lifetime. Extracting a separate capability seam becomes warranted when a launcher-independent provider or independently evolving consumers require it.
 
@@ -66,21 +104,11 @@ A caller adding a package completes its pnpm transaction before constructing a s
 
 Replacing, upgrading, or removing an already loaded package requires process restart because Node's ESM Module Map, CommonJS cache, existing object references, and running Workers can retain the old module identity. Generation replacement does not claim to unload modules.
 
-### Disk migration
+### Filesystem and runtime carriers
 
-Runtime-only launch paths do not create, update, or retire symlinks and proxy packages. The resolver treats the legacy shared fallback and `.dsh-module-fallback` projections as virtual insertion positions: a generation hit uses the table target, while a miss skips those old positions before continuing native ancestor lookup. During a dual phase, the launcher materializes and installs the same generation; tests disable each backend in turn and compare their targets.
+The resolver does not create, update, or remove fallback symlinks and proxy packages. Runtime resolution entries occupy their package names at `$DSH_HOME/profiles/node_modules`; every other name sees that directory as an ordinary ancestor, and symlinks anywhere in the profile tree are ordinary filesystem content without dedicated recognition. Profile-local package metadata and bundle dependency discovery follow the same Node lookup; ordinary pnpm-installed packages retain native precedence. The [lookup-order Note](2026-09-19-profile-resolution-lookup-order.md) records the complete order. Writable profile state and package-manager transactions remain outside the resolver.
 
-Legacy disk state remains available to link-only launches, old processes, and rollback without participating in runtime-only selection. Removing that state is a separate maintenance operation outside this change.
-
-### Mode behavior
-
-Link, dual, and runtime modes use the same generation schema and dependency-selection policy. Link mode persists the computed result, runtime mode installs it only in the process, and dual mode requires Node's materialized result to equal the generation route.
-
-The `dsh` launcher selects runtime mode when an ordinary Node caller omits `resolutionMode`. A pkg executable always selects runtime mode, and the Electron Host explicitly selects runtime mode in both development and packaged builds before any profile row mounts. Plain Node tests and low-level embedders can explicitly select link, dual, or runtime.
-
-Runtime mode requires a supported Node Internal loader interface and does not create, update, or retire fallback links. Dual mode retains link writes and fails when Node's disk result differs from the generation. Writable profile state and package-manager transactions remain outside the resolver.
-
-Pkg and Electron carriers force runtime resolution. The Electron Host runs through the Electron executable with `ELECTRON_RUN_AS_NODE=1`; packaged builds read the dsh tree from ASAR and map executable ASAR entries to electron-builder's unpacked tree. Their runtime resolvers do not create, update, or remove legacy resolution links.
+Runtime resolution requires a supported Node Internal loader interface. The Electron Host runs through the Electron executable with `ELECTRON_RUN_AS_NODE=1`; packaged builds read the dsh tree from ASAR and map executable ASAR entries to electron-builder's unpacked tree. Pkg and Electron use the same runtime resolution mechanism as ordinary Node launches.
 
 ### Performance and verification
 
@@ -88,11 +116,13 @@ Generation construction is startup or update work, not resolve work, and its abs
 
 One-off local measurements taken during implementation ran built JavaScript under plain Node in fresh processes and compared it with a process that installed no hook. The measurement script and results are not committed, and these figures are not a benchmark or CI budget. Seven alternating rounds covered outside, profile-local, and fallback imports through dynamic import, `import.meta.resolve`, require, and `require.resolve`. Across Node 22.19, 24.18, and 26.8, the largest positive hot-path median was 4.5%. On Node 24.18, a 256-package cold workload regressed by at most 11.2% and generation construction took 16.027 ms median; the 32-package local `require.resolve` case added 1.033 ms across the batch (+34.7%) from fixed startup cost.
 
-Behavior tests compare the runtime generation with the disk materializer over the same package trees, then exercise root order, transitive and peer dependencies, local and external precedence, exports and subpath errors, conditions, and explicit CommonJS options. The Node compatibility matrix runs the resolver, service, and bootstrap specifications across the supported internal-loader variants. Worker tests verify environment-data publication and bootstrap installation with mocked thread and native-loader interfaces; they do not launch a built Worker. Generation tests prove failed construction does not publish partial state and successful replacement is atomic.
+Behavior tests exercise root order, transitive and peer dependencies, local and external precedence, exports and subpath errors, conditions, and explicit CommonJS options. The Node compatibility matrix runs the resolver, service, and bootstrap specifications across the supported internal-loader variants. Worker tests verify environment-data publication and bootstrap installation with mocked thread and native-loader interfaces; they do not launch a built Worker. Generation tests prove failed construction does not publish partial state and successful replacement is atomic.
 
 ## Alternatives considered
 
-**Keep disk projections permanently.** This preserves native lookup without process hooks, but retains cross-process mutation, stale generations, proxy manifests, writer locks, and packaged-runtime divergence. A bounded dual migration remains useful because both backends consume the same generation.
+**Keep disk projections permanently.** This preserves native lookup without process hooks, but retains cross-process mutation, stale generations, proxy manifests, writer locks, and packaged-runtime divergence. Retaining link and dual as comparison modes would also keep the materializer and its lifecycle without a supported launcher that needs them.
+
+**Preserve logical symlink anchors.** This keeps lookup under the symlink's ancestors, but can select a different dependency from the one imported by the real package and can suppress tsx's workspace paths map. Canonical anchors keep eager dependency discovery and runtime delegation aligned with the package's execution location.
 
 **Expand the dependency graph lazily during resolve.** This spreads manifest reads and errors across first-use calls, changes timing from the disk implementation, complicates Worker startup, and makes the hot path depend on graph size. Complete generation construction is easier to compare and replace atomically.
 
@@ -106,15 +136,15 @@ Behavior tests compare the runtime generation with the disk materializer over th
 
 ## Verification
 
-- One eager computation supplies the retained disk materializer and runtime generation.
-- Link-only, dual, and runtime-only tests consume the same generation; runtime startup neither writes nor retires module-resolution data.
+- One eager computation supplies the runtime resolution; startup neither writes nor retires module-resolution data.
+- [Generation tests](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts) cover installation and selected-bundle graphs with ordinary directories and recursive symlinks, including different dependency versions beside logical and real anchors.
+- [Source-launch tests](../../../../apps/cli/tests/source-launch.compat.spec.ts) and [built-bin tests](../../../../apps/cli/tests/built-bin.e2e.ts) run both profile layouts through the real CLI. They assert ESM/CJS versions, loaded paths, per-format dependency identity, and consistent Tools/AgentLoop module instances with an accessible scheduler key.
 - Pkg and Electron carriers select runtime resolution; Electron executes its Host in Node mode from the ASAR-backed dsh tree while native executable entries remain unpacked.
 - ESM and CommonJS adapters share one router and delegate final resolution to Node without `module.registerHooks` or `_findPath` replacement.
 - Production metadata lookup does not record Loader import results or wrap Entry, registry, tree, or HMR methods.
 - The Node compatibility matrix runs main-thread resolver specifications across supported loader interfaces; service and bootstrap specifications cover Worker environment-data and installation interfaces without launching a built Worker.
 - One-off built plain-Node measurements produced the hot and cold observations above against no-hook Node; the script and results are not committed evidence.
-- Package READMEs, architecture references, generated catalogs, and the bilingual pair describe the shipped implementation.
 
 ## Consequences
 
-Runtime startup avoids disk mutation and proxy manifests while preserving the existing package-selection algorithm. It accepts the maintenance cost of Node Internal compatibility tests and an early, self-contained bootstrap in each owned Worker. Runtime is the ordinary Node launcher default, link and dual remain explicit comparison options, and pkg plus Electron carriers force runtime resolution without the resolver retiring old links. Generation replacement remains additive until the product owns module-cache invalidation and Worker restart.
+Runtime startup avoids disk mutation and proxy manifests while retaining package-precedence rules. Real-directory anchors align dependency discovery with default Node loading and tsx workspace mapping, including cases where a logical symlink path would select another version. The implementation accepts the maintenance cost of Node Internal compatibility tests and an early, self-contained bootstrap in each owned Worker; it provides no disk-only backend or dual comparison mode. Generation replacement remains additive until the product owns module-cache invalidation and Worker restart.
diff --git a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md
index 4a25386d99..d634ac9119 100644
--- a/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md
@@ -6,31 +6,69 @@ Status: implemented
 
 ## Problem
 
-profile 从自己的包项目加载插件配置项，而 Harness 包和所选 bundle 携带的包可能位于该项目普通依赖树之外。通过共享 symlink、profile 自有链接或打包可执行文件的代理包连接两棵依赖树，会让选包结果跨进程和安装版本持续存在。这些文件需要协调和锁来维护，并向元数据读取方暴露生成的代理 manifest，也无法原子表示进程内变更。
+profile 从自己的包项目加载插件配置项，而 Harness 包和所选 bundle 携带的包可能位于该项目普通依赖树之外。通过共享 symlink、profile 自有链接或打包可执行文件的代理包连接两棵依赖树，会让选包结果跨进程和安装版本持续存在。这些文件需要协调和锁来维护，并向元数据读取方暴露生成的代理 manifest（元数据清单），也无法原子表示进程内变更。
 
-运行时设计保留现有选包规则，不另建一套包策略。它覆盖插件模块内部的 import 以及 Loader 配置项的 import，并在主线程和 Harness 自有 Worker 中工作。generation 替换只接受新增包的集合，不会逐项修改正在使用的表。
+运行时设计保留安装优先、有序 bundle 和本地包优先于 fallback 的顺序。它覆盖插件模块内部的 import 以及 Loader 配置项的 import，并在主线程和 Harness 自有 Worker 中工作。generation 替换只接受新增包的集合，不会逐项修改正在使用的表。
 
 ## Decision
 
-profile 启动从磁盘 module fallback 使用的同一套依赖遍历生成一个不可变 `ResolutionGeneration`。launcher 默认使用 runtime 模式，把 generation 安装到 Node 的 ESM 与 CommonJS 解析器，不物化 fallback 链接。普通 Node 调用方和测试可以显式选择 link 模式以物化 generation，或选择 dual 模式以物化并校验它。`PluginPackages.replace()` 通过一次引用替换发布完整的新增型后继 generation。
+profile 启动生成一个不可变 `RuntimeResolution`，并将其安装到 Node 的 ESM 与 CommonJS 解析器。runtime 是唯一的解析后端，不提供模式选择器或磁盘物化器。`PluginPackages.replace()` 通过一次引用替换发布完整的新增型后继 generation。
 
 TypeScript CLI 入口显式选择 link 模式。其 tsx workspace 导入与 profile 插件必须共享模块 URL；同时加载 `src/index.ts` 与 `lib/index.js` 会产生不同的私有 Symbol 和服务身份。构建后的 CLI 保持 runtime 模式，`runProfile` 的显式解析模式覆盖仍然可用。
 
 ### 唯一选包算法
 
-包遍历继续放在 `@deepseek-ai/dsh-app-boot` 的 profile 加载代码旁。磁盘 materializer 和运行时解析器消费同一个纯计划；两者都不持有另一份优先级算法。普通 Node 调用方可以选择 link、dual 或 runtime 模式，省略模式时使用 runtime。打包可执行文件与 Electron Host 会选择 runtime，因为其依赖树可能位于虚拟文件系统；dual 保留为内部对比路径。
+包遍历属于 `@deepseek-ai/dsh-app-boot`，与 profile 加载代码放在一起。普通 Node、源码启动、打包可执行文件和 Electron Host 消费相同的 runtime resolution 与拦截。
 
-安装 manifest 是第一个根。它按 BFS 依次遍历 `dependencies` 和 `peerDependencies`，每条边从声明它的 manifest 解析，同名包由第一次找到的已安装包占有。所选 bundle 随后按 profile 顺序逐根遍历；每个较早根的完整依赖图优先于所有较晚根。安装闭包中的名称被保留，bundle 包根本身不成为插件 fallback。与旧行为相同，已声明但未安装的包会被跳过。
+安装 manifest 是第一个根。它按 BFS 依次遍历 `dependencies` 和 `peerDependencies`，每条边从声明它的 manifest 解析，同名包由第一次找到的已安装包占有。所选 bundle 随后按 profile 顺序逐根遍历；每个较早根的完整依赖图优先于所有较晚根。安装闭包中的名称被保留，bundle 包根本身不成为插件 fallback。已声明但未安装的包会被跳过。
 
-profile 本地和插件私有 `node_modules` 不进入 fallback entries，由 Node 在虚拟 fallback 位置之前选择。generation 只记录已安装的 profile 直接包名用于 native 快速分流；每个 fallback 记录包名、版本、旧规则选中的查找目录、声明该边的 manifest 锚点和作用域，足以从选定包重新进入 Node 原生解析并验证换代保持既有映射。
+依赖展开时，每个安装根、所选 bundle 根和递归依赖 manifest 都以所属包的真实目录作为查找锚点。因此，祖先 `node_modules` 查找沿 Node 通常执行该包的位置进行，而不是沿指向该包的软链接位置进行。同一声明锚点会被记录下来，供运行时委托解析使用。逻辑路径与真实路径的祖先不同时，这可能改变所选版本，也可能使原本能发现的依赖不再被收录；它不只是对已存路径换一种写法。
 
-旧 `healProfilesModuleFallback()` 保留为相同纯计算结果的磁盘 materializer，便于直接比较并避免重写旧规则。具名 profile 启动只在显式 link 或 dual 模式下调用它。runtime 模式只计算 generation 而不物化，dual 模式会物化并安装该 generation 进行比较。
+profile 本地和插件私有 `node_modules` 条目优先于 runtime resolution 条目。runtime resolution 记录已安装的 profile 直接包名，用于无 I/O 的原生快速分流。每个条目记录包名、版本、选定的查找目录、声明该边的 manifest 锚点和作用域，供原生解析与后继 generation 校验使用。
+
+对于 profile 无法通过自身祖先目录找到的依赖，runtime resolution 的 profile 作用域条目仍然必要。它们将已安装 manifest 中的依赖展开到当前 profile 的 runtime resolution，而不是为每个插件建立独立依赖图。它既不下载包，也不扫描源码 import。运行时钩子在考虑原生本地候选后使用这张表。
+
+### 普通安装与软链接示例
+
+下面两种布局中，profile 都选中 `my-bundle`，其 manifest 声明 `bridge`；只有 `bridge` 声明 `leaf`。安装包集合和 profile 的直接包都不提供 `leaf`，`bridge` 也没有私有 `node_modules/leaf`。这些路径示意了[共享 CLI（命令行界面）profile 测试](../../../../apps/cli/tests/profiles/headless/tests/profile-resolution.ts)覆盖的两种布局。
+
+普通安装目录中，`bridge` 向上查找所属 bundle 的 `node_modules`，找到版本 1.0.0。另一个版本 2.0.0 不在这条查找路径上：
+
+```text
+/case/home/profiles/headless/node_modules/my-bundle/
+  node_modules/bridge/
+  node_modules/leaf/                                  # 1.0.0
+/case/dependencies/node_modules/leaf/                 # 2.0.0
+```
+
+bundle 采用 npm-link 风格链接，且其传递依赖也被软链接时，bundle 从 `/case/work/my-bundle` 展开，下一层依赖则从 `/case/dependencies/bridge` 开始展开。该次展开找到真实包旁边的版本 2.0.0：
+
+```text
+/case/home/profiles/headless/node_modules/my-bundle -> /case/npm-global/node_modules/my-bundle
+/case/npm-global/node_modules/my-bundle -> /case/work/my-bundle
+/case/work/my-bundle/node_modules/bridge -> /case/dependencies/bridge
+/case/work/my-bundle/node_modules/leaf/                # 1.0.0
+/case/dependencies/node_modules/leaf/                 # 2.0.0
+```
+
+| Profile 包布局 | 解析 `leaf` 时使用的声明目录 | `tsx/esm` 源码启动 | 普通 Node `lib` 启动 |
+|---|---|---|---|
+| 普通目录 | `/case/home/profiles/headless/node_modules/my-bundle/node_modules/bridge` | 1.0.0 | 1.0.0 |
+| bundle 与 bridge 均为软链接 | `/case/dependencies/bridge` | 2.0.0 | 2.0.0 |
+
+ESM `import` 和 CommonJS `require` 都选中这些版本。在每种模块格式内部，通过 profile fallback 导入 `leaf` 与在 `bridge` 内部导入它，会得到同一个模块实例。优先级更高的原生 profile 包，或安装集合已保留的同名 fallback，仍按选包规则优先；fallback 不会强制所有导入方都使用版本 2.0.0。
+
+### 源码与构建产物的模块身份
+
+[源码启动器](2026-07-29-dsh-source-launch-tsx-esm.zh.md)使用 tsx 的 ESM-only 钩子。导入方 URL 含有 `/node_modules/` 时，tsx 会跳过 tsconfig `paths`。因此，把 workspace 软链接的逻辑路径用作 fallback 声明锚点，可能选中构建后的 `lib/` 导出，而这些模块在真实 workspace 路径中发起的 import 又通过 paths 映射选中 `src/`。真实声明锚点让 workspace import 一致遵循源码映射；没有匹配 workspace 映射的包仍使用普通包导出解析。
+
+例如，`@deepseek-ai/dsh-tools` 使用 `Symbol()` 创建 scheduler 键。从 `lib/` 加载的 Tools 实例，无法通过另一个 `src/` 模块实例导入的键暴露该 scheduler。源码启动让 Tools 与 AgentLoop 都位于 `src/`；普通 Node 启动让两者都位于 `lib/`。scheduler 保留模块本地的 Symbol；正确的 import 共享同一个模块实例。
 
 ### 不可变 generation
 
-一个解析器 registration 持有一个 `current` generation。每个同步 resolve 在入口只捕获一次该引用，完整调用只读该引用。generation 构造在发布前读取所有必需 manifest；失败时当前 generation 不变。发布成功只替换一个引用，执行中的调用可以继续使用它已捕获的 generation。
+一个 runtime interception 持有一个 `current` generation。每个同步 resolve 在入口只捕获一次该引用，完整调用只读该引用。generation 构造在发布前读取所有必需 manifest；失败时当前 generation 不变。发布成功只替换一个引用，执行中的调用可以继续使用它已捕获的 generation。
 
-选包缓存和包元数据缓存归 generation 所有。发布下一代后，旧 generation 在调用方退出后自然不可达，不逐项清理缓存。generation 命中和原生解析成功结果可以缓存，但 generation 未命中会重新扫描，因此未命中后安装的 profile 本地包会像 link 模式一样变为可见。显式 CommonJS paths 或非默认 conditions 不得复用默认解析缓存。
+选包缓存和包元数据缓存归 generation 所有。发布下一代后，旧 generation 在调用方退出后自然不可达，不逐项清理缓存。generation 命中和原生解析成功结果可以缓存，但 generation 未命中会重新扫描，因此未命中后安装的 profile 本地包会通过原生查找变为可见。显式 CommonJS paths 或非默认 conditions 不得复用默认解析缓存。
 
 launcher 只构造启动 generation。服务接受新增型后继 generation，但本实现没有包管理器事务调用替换操作。
 
@@ -38,7 +76,7 @@ launcher 只构造启动 generation。服务接受新增型后继 generation，
 
 resolver 使用 `node-addon-require-builtin` 读取 `internal/modules/esm/loader` 和 `internal/modules/cjs/loader`。ESM 适配器包装每线程单例 `CascadedLoader` 的 resolve 方法。CommonJS 适配器包装内部 builtin 导出的 `Module._resolveFilename`；该 `Module` 与 `node:module` 导出的对象相同。
 
-两个适配器调用同一个路由函数。builtin、相对或绝对路径、URL、profile 作用域外 parent 和支持的查找以外的显式调用都直接委托原生实现。`#imports` 请求使用所属 manifest 中的 Node 映射；外部 bare target 按相同 conditions 遵循本地包、generation 和 after-fallback 的选包顺序，精确 target 解析仍由 Node 负责。对于作用域内的 bare request，package self-reference 保留原 parent，即使 npm alias 使安装目录使用另一个名称。Node 能在虚拟共享 fallback 之前从 profile 本地包或插件私有包解析到所请求入口时，也保留原 parent；没有 `exports` 的 CommonJS 包目录仅缺少所请求 subpath 时，不会压过 fallback。其他请求在 generation 命中时通过该条目的声明锚点解析，未命中时从虚拟 fallback 之后继续原生查找。显式 CommonJS path 列表按调用方顺序，对每个 path 独立应用相同的插入规则。
+两个适配器调用同一个路由函数。builtin、相对或绝对路径、URL、profile 作用域外 parent 和支持的查找以外的显式调用都直接委托原生实现。`#imports` 请求使用所属 manifest 中的 Node 映射；外部 bare target 按相同 conditions 遵循本地包、interception 和 native-after-interception 的选包顺序，精确 target 解析仍由 Node 负责。对于作用域内的 bare request，package self-reference 保留原 parent，即使 npm alias 使安装目录使用另一个名称。Node 能在虚拟共享 fallback 之前从 profile 本地包或插件私有包解析到所请求入口时，也保留原 parent；没有 `exports` 的 CommonJS 包目录仅缺少所请求 subpath 时，不会压过 fallback。其他请求在 interception 命中时通过该条目的声明锚点解析，未命中时从虚拟 fallback 之后继续原生查找。显式 CommonJS path 列表按调用方顺序，对每个 path 独立应用相同的插入规则。
 
 适配器完成路由后调用捕获的原生 resolver。exports、import/require conditions、main、subpath、扩展名、原生缓存和错误码仍归 Node 处理。路由后的 ESM 失败会把 Node 诊断中的内部查找锚点替换为原始 importer。选中包的无效 export 或缺失目标不会触发另一个同名候选。CommonJS 不替换 `_findPath`，也不复制 `_resolveFilename`。
 
@@ -46,11 +84,11 @@ resolver 使用 `node-addon-require-builtin` 读取 `internal/modules/esm/loader
 
 ### 活动插件列表与包元数据
 
-resolution generation 列出可用 fallback 包；Loader entries 组成活动插件列表，两者不能合并。消费方继续使用 Loader 原有 entry 生命周期，并按自身 scope 过滤相关 entries。需要 package metadata 的消费方将 specifier 和所属树的 base URL 交给 app-boot 中的轻量服务，无需 package 导出 `./package.json`。安装 generation 后，即使查询未命中也以 generation 为准；底层嵌入方只安装服务而不提供 generation 时，服务保留 Node 原生查找。
+runtime resolution 列出它提供的包；Loader entries 组成活动插件列表，两者不能合并。消费方继续使用 Loader 原有 entry 生命周期，并按自身 scope 过滤相关 entries。需要 package metadata 的消费方将 specifier 和所属树的 base URL 交给 app-boot 中的轻量服务，无需 package 导出 `./package.json`。安装 runtime resolution 后，即使查询未命中也以它为准；底层嵌入方只安装服务而不提供 runtime resolution 时，服务保留 Node 原生查找。
 
 解析器不提供 `imported(entry)`，不观察 ModuleJob，不包装 Entry 方法，不把 fiber 与 import 调用关联，也不替换 registry、tree 或 HMR 方法。重复查询读取同一个 generation，因此不会偏离 import 使用的路线。需要包元数据的非 Node importer 必须显式实现同一个确定性 resolver 接口，不能把调用来源推断重新引入 Node 主路径。
 
-实现集中在 `app-boot/src/profile-resolution/`。`service.ts` 提供长期存在的 `ctx.pluginPackages`，并拥有主线程 resolver 与 Worker generation 的生命周期；`resolver.ts` 实现 generation 查询和 Node Internal 适配器；`worker-bootstrap.ts` 在线程内安装继承的 generation。旧 profile 选包和磁盘 materialize 逻辑留在 `profile.ts`。Worker 只通过 `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` 公开入口引用 bootstrap。
+实现集中在 `app-boot/src/profile-resolution/`。`service.ts` 提供长期存在的 `ctx.pluginPackages`，并拥有主线程拦截与 Worker runtime resolution 的生命周期；`resolver.ts` 实现 runtime resolution 查询和 Node Internal 适配器；`worker-bootstrap.ts` 在线程内安装继承的 runtime resolution。profile 选包和 runtime resolution 构造留在 `profile.ts`。Worker 只通过 `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` 公开入口引用 bootstrap。
 
 服务定义与提供方继续放在 `app-boot`，因为 profile boot 拥有 resolver 生命周期。出现与 launcher 无关的提供方或需要独立演进的消费方时，再抽出单独的能力 seam。
 
@@ -66,21 +104,11 @@ resolution generation 列出可用 fallback 包；Loader entries 组成活动插
 
 替换、升级或删除已加载包需要重启，因为 Node 的 ESM Module Map、CommonJS cache、现存对象引用和运行中的 Worker 都可能保留旧模块 identity。generation 换代不声称卸载模块。
 
-### 磁盘迁移
+### 文件系统与运行时载体
 
-runtime-only 启动流程不创建、更新或退休 symlink 和代理包。resolver 把旧共享 fallback 和 `.dsh-module-fallback` 投影视为虚拟插入位置：generation 命中时使用表中目标，未命中时越过旧位置继续原生祖先查找。dual 阶段物化并安装同一个 generation；测试分别禁用一个后端并比较目标。
+解析器不创建、更新或删除 fallback 软链接与代理包。runtime resolution 条目占据 `$DSH_HOME/profiles/node_modules` 上各自的包名位置；其余包名把该目录当作普通祖先，profile 树内任何位置的软链接都是普通文件系统内容，没有专门识别。profile 本地包元数据与 bundle 依赖展开遵循同一套 Node 查找；正常由 pnpm 安装的包保留原生优先级。完整顺序见[查找顺序 Note](2026-09-19-profile-resolution-lookup-order.zh.md)。可写 profile 状态和包管理器事务不属于解析器。
 
-旧磁盘状态继续供 link-only 启动、旧进程和回滚使用，但不参与 runtime-only 选择。清理旧链接是本次变更之外的独立维护操作。
-
-### 模式行为
-
-link、dual 与 runtime 模式使用同一种 generation schema 和依赖选择策略。link 模式持久化计算结果，runtime 模式只在进程内安装，dual 模式要求 Node 的磁盘结果与 generation 路由一致。
-
-普通 Node 调用方省略 `resolutionMode` 时，`dsh` launcher 选择 runtime 模式。pkg 可执行文件始终选择 runtime，Electron Host 在开发与打包构建中也会在挂载任何 profile 条目前显式选择 runtime。普通 Node 测试与底层嵌入方可以显式选择 link、dual 或 runtime。
-
-runtime 模式要求受支持的 Node Internal loader 接口，并且不会创建、更新或退休 fallback 链接。dual 模式保留链接写入，并在 Node 的磁盘结果与 generation 不同时失败。可写 profile 状态和包管理器事务不属于 resolver。
-
-pkg 与 Electron 载体强制使用 runtime 解析。Electron Host 通过设置 `ELECTRON_RUN_AS_NODE=1` 的 Electron 可执行文件运行；打包构建从 ASAR 读取 dsh 依赖树，并把 ASAR 中的可执行条目映射到 electron-builder 的 unpacked 目录。它们的运行时解析器不会创建、更新或删除旧解析链接。
+运行时解析要求受支持的 Node Internal loader 接口。Electron Host 通过设置 `ELECTRON_RUN_AS_NODE=1` 的 Electron 可执行文件运行；打包构建从 ASAR 读取 dsh 依赖树，并把 ASAR 中的可执行条目映射到 electron-builder 的 unpacked 目录。pkg 与 Electron 使用和普通 Node 启动相同的 runtime resolution 机制。
 
 ### 性能与验证
 
@@ -88,11 +116,13 @@ generation 构造发生在启动或显式更新阶段，不属于单次 resolve
 
 实现期间的一次性本地测量用 plain Node 在全新进程中执行构建后的 JavaScript，并与完全没有安装 hook 的进程比较。测量脚本和结果未提交，这些数据不是 benchmark 或 CI 预算。七轮交替顺序覆盖 outside、profile-local 和 fallback 的 dynamic import、`import.meta.resolve`、require、`require.resolve`。Node 22.19、24.18 和 26.8 的热路径中位数最大正向回退为 4.5%。Node 24.18 的 256 包 cold workload 最大回退为 11.2%，generation 构造中位数为 16.027 ms；32 包本地 `require.resolve` 因固定启动成本在整批增加 1.033 ms（+34.7%）。
 
-行为测试在同一包树上比较运行时 generation 与磁盘 materializer，再覆盖根顺序、传递依赖和 peer、本地与外层优先级、exports 与 subpath 错误、conditions 和显式 CommonJS options。Node 兼容矩阵会在受支持的内部 loader 变体上运行 resolver、service 和 bootstrap 规格。Worker 测试通过 mock 线程与 native loader 接口验证 environment data 发布和 bootstrap 安装，但不会启动构建后的 Worker。generation 测试证明构造失败不发布部分状态，成功换代只做原子引用替换。
+行为测试覆盖根顺序、传递依赖和 peer、本地与外层优先级、exports 与 subpath 错误、conditions 和显式 CommonJS options。Node 兼容矩阵会在受支持的内部 loader 变体上运行解析器、服务和 bootstrap 规格。Worker 测试通过 mock 线程与原生 loader 接口验证 environment data 发布和 bootstrap 安装，但不会启动构建后的 Worker。generation 测试证明构造失败不发布部分状态，成功换代只做原子引用替换。
 
 ## Alternatives considered
 
-**永久保留磁盘投影。** 这能在没有进程 hook 时沿用原生查找，但仍有跨进程写入、陈旧 generation、代理 manifest、写锁和打包运行时差异。迁移期 dual 模式仍有价值，因为两个后端消费同一个 generation。
+**永久保留磁盘投影。** 这能在没有进程钩子时沿用原生查找，但仍有跨进程写入、陈旧 generation、代理 manifest、写锁和打包运行时差异。把 link 与 dual 保留为对比模式，也会留下没有受支持启动器需要的物化器及其生命周期。
+
+**保留软链接逻辑锚点。** 这会沿软链接的祖先查找，但可能选中与真实包内部 import 不同的依赖，也可能抑制 tsx 的 workspace paths 映射。规范化锚点让 eager 依赖发现与运行时委托解析都对齐包的执行位置。
 
 **在 resolve 时惰性扩展依赖图。** 这会把 manifest 读取和错误分散到首次使用，改变磁盘实现的时机，使 Worker 启动更复杂，并让热路径成本随依赖图变化。完整构造 generation 更容易比较和原子替换。
 
@@ -106,15 +136,15 @@ generation 构造发生在启动或显式更新阶段，不属于单次 resolve
 
 ## Verification
 
-- 一次 eager 计算同时供应保留的磁盘 materializer 和运行时 generation。
-- link-only、dual 和 runtime-only 测试消费同一个 generation；runtime 启动既不写入也不退休模块解析数据。
+- 一次 eager 计算供应 runtime resolution；启动既不写入也不退休模块解析数据。
+- [Generation 测试](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts)覆盖普通目录和递归软链接下的安装图与所选 bundle 图，包括逻辑锚点和真实锚点旁存在不同依赖版本的情况。
+- [源码启动测试](../../../../apps/cli/tests/source-launch.compat.spec.ts)与[构建入口测试](../../../../apps/cli/tests/built-bin.e2e.ts)通过真实 CLI 运行两种 profile 布局，断言 ESM/CJS 版本、加载路径、各模块格式内的依赖身份，以及一致的 Tools/AgentLoop 模块实例和可访问的 scheduler 键。
 - pkg 与 Electron 载体选择 runtime 解析；Electron 以 Node 模式从 ASAR 承载的 dsh 依赖树执行 Host，原生可执行条目保持 unpacked。
 - ESM 与 CommonJS 适配器共享同一个路由器，并把最终解析委托给 Node，不使用 `module.registerHooks` 或替换 `_findPath`。
 - 生产 package metadata 查询不记录 Loader import 结果，也不包装 Entry、registry、tree 或 HMR 方法。
 - Node 兼容矩阵会在受支持的 loader 接口上运行主线程 resolver 规格；service 和 bootstrap 规格覆盖 Worker environment data 与安装接口，但不会启动构建后的 Worker。
 - 一次性 plain Node 构建产物测量得到上述相对无 hook Node 的热路径和 cold 观察结果；脚本与结果并未提交为证据。
-- package README、架构引用、生成目录和双语文档对描述已交付实现。
 
 ## Consequences
 
-runtime 启动避免磁盘修改和代理 manifest，同时保留既有选包算法。代价是持续维护 Node Internal 兼容测试，并在每个自有 Worker 中最早执行自包含 bootstrap。runtime 是普通 Node launcher 的默认值，link 与 dual 保留为显式对比选项；pkg 与 Electron 载体强制使用 runtime，解析器不退休旧链接。在产品拥有模块缓存失效和 Worker 重启前，generation 替换只能新增映射。
+runtime 启动避免磁盘修改和代理 manifest，同时保留包优先级规则。真实目录锚点让依赖发现对齐 Node 默认加载与 tsx workspace 映射，也覆盖软链接逻辑路径会选中另一版本的情况。实现需要持续维护 Node Internal 兼容测试，并在每个自有 Worker 中尽早执行自包含 bootstrap；它不提供纯磁盘后端或 dual 对比模式。在产品拥有模块缓存失效和 Worker 重启前，generation 替换只能新增映射。
diff --git a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml
index 321c9c8c58..62399c273d 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
-2026-09-10-desktop-web-wrapper.md: 05210e2ab85f0afe6d0275e25f31ce8addf11332
-2026-09-10-desktop-web-wrapper.zh.md: 84e72c9261250b103245f974e1a0546a4898e9ca
+2026-09-10-desktop-web-wrapper.md: 4f43cc650777596c807cf79463edc7a9131db44b
+2026-09-10-desktop-web-wrapper.zh.md: bc41b4f8eff1dca7fc3dd9b934dac257a9d10a6b
diff --git a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
index 05210e2ab8..4f43cc6507 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.md
@@ -14,7 +14,7 @@ Separate Desktop composition and request transport require their own configurati
 
 The private Desktop Host invokes the CLI's shared profile runner against the independently owned Desktop profile. The complete Web composition owns authentication, HTTP routes, client assets, RPC, and response streaming. Electron loads packaged static Web assets before the child is ready. Child IPC carries readiness, structured boot injections, and shutdown. The [immediate-window decision](2026-09-09-desktop-immediate-window-and-direct-start.md) owns local-document HTTP forwarding and authenticated WebSocket access; Web retains application dispatch and stream framing.
 
-The shared runner owns profile and Harness-home patches, proxy setup, telemetry defaults, module fallbacks, configuration reload, and application lifecycle. Desktop initializes profiles from the shared Web template and uses its Plugin Manager in the main application. Electron owns windows, menus, native directory selection, recovery, and release updates.
+The shared runner owns profile and Harness-home patches, proxy setup, telemetry defaults, the runtime resolution, configuration reload, and application lifecycle. Desktop initializes profiles from the shared Web template and uses its Plugin Manager in the main application. Electron owns windows, menus, native directory selection, recovery, and release updates.
 
 The [bundled-runtime decision](2026-09-08-desktop-bundled-runtime-and-external-plugins.md) retains separate runtime and plugin storage, bundled pnpm and explicit package ownership. The public CLI continues to reject the reserved Desktop profile. Electron profile preparation and native recovery remain available without a working Host.
 
@@ -22,7 +22,7 @@ Independent package ownership prevents CLI and Desktop from modifying each other
 
 The shared Web plugin manager owns installation, activation, errors, and restart requirements. Electron has no separate plugin-management renderer, preload, shell asset route, plugin IPC, or package-mutation runner. Packaging explicitly selects the main entry and application preload so stale build outputs cannot restore the removed bridge.
 
-Shared `initProfile` creates missing profile files and preserves existing content. The Host’s `healIsolatedProfileModuleFallback` is the sole owner of installation and bundle projections; package operations use shared `unlinkProfileModuleFallback` to detach only its own links before pnpm. pnpm-managed directories retain priority. Desktop maintains no second runtime-state, lockfile hash, or link reconciliation mechanism. One-time cleanup of `desktop-runtime-state.json` removes only matching recorded links and retires that metadata.
+Shared `initProfile` creates missing profile files and preserves existing content. The Host computes its runtime resolution with `createRuntimeResolution` and installs it through `PluginPackages`, without writing fallback links. pnpm-managed directories retain priority. Desktop maintains no second runtime-state, lockfile hash, or link reconciliation mechanism.
 
 This partially supersedes the private composition and portless transport in the [packaging decision](2026-08-25-electron-desktop-packaging-and-updates.md). That design avoided listening ports and used framed byte pipes to avoid Base64 expansion and cross-version V8 serialization. Shared HTTP gives up the portless guarantee and assigns serving and authentication to the existing Web implementation. Release identity, signing, process ownership, and native shell features remain active decisions.
 
@@ -36,7 +36,7 @@ Native directory selection in the local application uses a narrow preload IPC ca
 
 **Merge CLI and Desktop plugin installations.** Shared boot code does not require shared executable dependencies. Separate installations allow independently qualified releases and plugin versions while their existing data owners govern shared sessions and settings.
 
-**Keep a Desktop link ledger and manifest reconciler.** These duplicate shared profile mechanisms and can reject otherwise usable installations when derived metadata drifts. A single fallback owner can protect pnpm directories without maintaining release identity in the plugin profile.
+**Keep a Desktop link ledger and manifest reconciler.** These duplicate shared profile mechanisms and can reject otherwise usable installations when derived metadata drifts. A single owner of the runtime resolution can protect pnpm directories without maintaining release identity in the plugin profile.
 
 **Keep a separate native plugin-management page.** It can operate while the Web Host is unavailable, but duplicates package operations, renderer IPC, localization, and backend restart handling. Native recovery already supports disabling third-party bundles and backing up the profile patch without the Host. Reintroduction requires a repair operation that this recovery cannot provide.
 
diff --git a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md
index 84e72c9261..bc41b4f8ef 100644
--- a/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-10-desktop-web-wrapper.zh.md
@@ -14,7 +14,7 @@ Status: implemented
 
 私有 Desktop Host 针对独立归属的 Desktop profile 调用 CLI 的共享 profile runner。完整 Web 组合负责认证、HTTP 路由、客户端资源、RPC 与响应流。Electron 在子进程就绪前加载打包静态 Web 资源。子进程 IPC 承载就绪、结构化启动注入与关闭。[立即显示窗口决策](2026-09-09-desktop-immediate-window-and-direct-start.zh.md)规定本地文档 HTTP 转发与认证 WebSocket 访问；Web 保留应用分派与流帧处理。
 
-共享 runner 负责 profile 与 Harness-home patch、代理设置、遥测默认值、模块补全、配置重载和应用生命周期。Desktop 从共享 Web 模板初始化 profile，并在主应用中使用其插件管理器。Electron 负责窗口、菜单、原生目录选择、恢复和发布更新。
+共享 runner 负责 profile 与 Harness-home patch、代理设置、遥测默认值、runtime resolution、配置重载和应用生命周期。Desktop 从共享 Web 模板初始化 profile，并在主应用中使用其插件管理器。Electron 负责窗口、菜单、原生目录选择、恢复和发布更新。
 
 [内置运行时决策](2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md)保留独立运行时与插件存储、内置 pnpm，以及明确的包归属。公开 CLI 继续拒绝保留的 Desktop profile。Electron profile 准备和原生恢复在 Host 不可用时仍可执行。
 
@@ -22,7 +22,7 @@ Status: implemented
 
 共享 Web 插件管理器负责安装、激活、错误和重启要求。Electron 不提供独立插件管理渲染器、preload、shell 资源路由、插件 IPC 或包变更执行器。打包明确选择主入口和应用 preload，避免旧构建产物重新带入已删除的桥接。
 
-共享 `initProfile` 创建缺失的 profile 文件并保留现有内容。Host 的 `healIsolatedProfileModuleFallback` 是安装包与 bundle 投影的唯一归属方；包操作在 pnpm 前通过共享 `unlinkProfileModuleFallback` 仅分离它自己拥有的链接。pnpm 管理的目录保持优先。Desktop 不维护第二套运行时状态、锁文件哈希或链接协调机制。`desktop-runtime-state.json` 的一次性清理仅移除与记录匹配的链接，并清除该元数据。
+共享 `initProfile` 创建缺失的 profile 文件并保留现有内容。Host 通过 `createRuntimeResolution` 计算 runtime resolution，并通过 `PluginPackages` 安装它，不写入 fallback 链接。pnpm 管理的目录保持优先。Desktop 不维护第二套运行时状态、锁文件哈希或链接协调机制。
 
 本记录部分取代[打包决策](2026-08-25-electron-desktop-packaging-and-updates.zh.md)中的私有组合与无端口传输。该设计避免监听端口，并使用分帧字节管道避免 Base64 膨胀与跨版本 V8 序列化。共享 HTTP 放弃无端口保证，将服务与认证交给已有 Web 实现。发布身份、签名、进程归属及原生壳功能仍是有效决策。
 
@@ -36,7 +36,7 @@ Status: implemented
 
 **合并 CLI 与 Desktop 插件安装。** 共享启动代码不要求共享可执行依赖。独立安装允许分别验收发布与插件版本，共享会话和设置则仍由已有数据归属方负责。
 
-**保留 Desktop 链接账本与 manifest 协调器。** 这些机制重复共享 profile 逻辑，并可能因派生元数据漂移而拒绝原本可用的安装。单一模块补全归属方可以保护 pnpm 目录，无需在插件 profile 中维护发布身份。
+**保留 Desktop 链接账本与 manifest 协调器。** 这些机制重复共享 profile 逻辑，并可能因派生元数据漂移而拒绝原本可用的安装。单一 runtime resolution 归属方可以保护 pnpm 目录，无需在插件 profile 中维护发布身份。
 
 **保留独立原生插件管理页。** 它可以在 Web Host 不可用时运行，但重复维护包操作、渲染器 IPC、本地化和后端重启处理。原生恢复已能在没有 Host 时禁用第三方 bundle 并备份 profile patch。只有出现此恢复方式无法提供的修复操作时，才应重新引入。
 
diff --git a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.i18n.yaml
new file mode 100644
index 0000000000..08712a98da
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md
+2026-09-17-frame-shell-leading-window-chrome-seat.md: cc3ef576900e38dc26c46438fd5d490ac4361be0
+2026-09-17-frame-shell-leading-window-chrome-seat.zh.md: c652f313d4f4863decc14e556a1674487d1d3fea
diff --git a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md
new file mode 100644
index 0000000000..cc3ef57690
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md
@@ -0,0 +1,38 @@
+# Agent Note: Frame-owned shell.leading window-chrome seat
+
+Status: implemented
+
+English | [中文](2026-09-17-frame-shell-leading-window-chrome-seat.zh.md)
+
+## Problem
+
+The [macOS hidden-titlebar work](../feature/2026-09-13-macos-hidden-titlebar-vibrancy.md) hid the collapsed sidebar column entirely on darwin and moved the reopen and New Session controls into a conversation-header slot (`conversation.session.header.leading`), shown via CSS while `data-sidebar-collapsed` was published. Only the Conversation had that seat: with any other main panel selected (the plugin manager, or any future global panel), a collapsed window kept the floating traffic lights over the panel's content with no reopen control anywhere on screen. Each new panel would have had to grow its own leading seat and repeat the same clearance geometry.
+
+## Decision
+
+The window chrome belongs to the frame, not to one panel. ui-layout declares a fifth root-scoped child slot, `shell.leading` (single), and AppFrame renders its seat as a frame-level box over the columns — mounted only on the darwin desktop while `sidebarCollapsed`, the full-hide state that leaves window chrome without a home (Windows' zero-width collapse keeps its fixed caption controls, so the seat must not mount a second set there). The seat sits at the frame's top-left (left 88px clears the hiddenInset traffic lights, top 11px centers the 28px controls on the conversation title row, z-index 15 above column content and below frame overlays) and carries `-webkit-app-region: no-drag`, subtracting itself from any drag band beneath it.
+
+Under the same collapsed condition the frame publishes `--dsh-frame-leading-clearance: 160px` — the inline band the traffic lights plus the seat's two controls occupy, measured from the frame's left edge. Window fullscreen hides the traffic lights (the desktop preload mirrors the state onto `html[data-fullscreen]`): the seat moves to `left: 12px` into their vacated band and the clearance drops to `84px`. The conversation title row is the one consumer: it pads `max(0px, clearance - 20px)` (its header already pads 20px). Entry pages that start below the window strip in both sidebar states (the plugin manager's page head) instead pad their top by `--dsh-frame-top-clearance` (48px, published on the darwin frame unconditionally), which clears the strip vertically rather than indenting inline.
+
+ui-sidebar registers `HeaderLeadingControls` into `shell.leading` instead of the conversation seat, reusing the shell's inject face and locale; the component renders unconditionally because the frame owns the mount condition, and its platform check and CSS collapse-gating are deleted. This also drops ui-sidebar's dependency on ui-conversation. The original `conversation.session.header.leading` slot is gone per the pre-stable API rule (every consumer updated, no compatibility shim); the conversation header now exposes its own sessionless `conversation.header.leading` seat (root-scoped, rendered without a Session) as a public extension point, empty in the shipped composition because the window-chrome controls live in `shell.leading`.
+
+## Alternatives considered
+
+**Keeping the conversation seat and adding one per panel.** Every main panel would repeat the seat markup, the drag-region subtraction, and the traffic-light geometry, and a panel that forgot would strand a collapsed window without a reopen control. One frame-owned seat makes the guarantee structural.
+
+**Mounting the occupant always and gating visibility in CSS (the prior mechanism).** This kept dead DOM and a no-drag subtraction in the header on every platform and every collapse state, and it could not help non-conversation panels at all. A frame-level TSX mount keeps the condition, the seat geometry, and the clearance publication in one file.
+
+**Gating the seat on rightbar fullscreen as well.** Unnecessary: the fullscreen right panel (z-index 40) covers the seat (15) visually, and it already opts its whole box out of window dragging, so the seat's geometry cannot puncture it.
+
+**Publishing clearance as a fixed padding each consumer hardcodes.** A raw `160px` in each panel would silently desynchronize from the seat's real band; one custom property published under exactly the mount condition keeps consumers correct when the geometry changes.
+
+## Consequences
+
+- Every current and future main panel keeps the reopen and New Session controls while the sidebar is hidden, at zero per-panel cost; the conversation opts into `--dsh-frame-leading-clearance`, and entry pages take the unconditional `--dsh-frame-top-clearance` instead.
+- `conversation.session.header.leading` no longer exists in the client catalog; `shell.leading` carries the window chrome as a public root-scoped seat, while the conversation header's sessionless `conversation.header.leading` remains a separate public seat with no shipped occupant.
+- ui-sidebar no longer depends on ui-conversation (inject list, devDependency, and tsconfig reference removed).
+- The mount condition names darwin explicitly: Windows' `data-windows-titlebar` collapse also yields a zero-width column but keeps its own fixed caption controls, which a frame seat would duplicate. A platform that later hides its column without leaving its own chrome opts in by widening the condition.
+
+## Testing
+
+The ui-layout app-frame spec pins the seat's mount and unmount across the darwin collapse and its absence beside the 56px rail; the apply spec pins the five-slot declaration and teardown. The ui-sidebar apply spec pins the `shell.leading` registration (component, locale, shared inject face) and its removal on dispose; the sidebar-root spec pins the two controls' actions.
diff --git a/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md
new file mode 100644
index 0000000000..c652f313d4
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md
@@ -0,0 +1,38 @@
+# Agent Note: 框架持有的 shell.leading 窗口 chrome 座
+
+Status: implemented
+
+[English](2026-09-17-frame-shell-leading-window-chrome-seat.md) | 中文
+
+## Problem
+
+[macOS 隐藏标题栏工作](../feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md)在 darwin 上把收起的侧边栏整列隐藏，并把重新打开与 New Session 控件移入会话头部的 slot（`conversation.session.header.leading`），在 `data-sidebar-collapsed` 发布期间由 CSS 显示。但只有会话界面有这个座：选中任何其他主面板（插件管理器或未来的全局面板）时，收起的窗口只剩悬浮的红绿灯压在面板内容上，屏幕上没有任何重新打开控件。每个新面板都得自建 leading 座并重复同一套避让几何。
+
+## Decision
+
+窗口 chrome 属于框架，不属于某个面板。ui-layout 声明第五个 root 作用域子 slot `shell.leading`（single），AppFrame 把它的座渲染为覆盖各列的框架级盒子——仅在 darwin 桌面且 `sidebarCollapsed` 时挂载，即让窗口 chrome 无处安放的全隐藏状态（Windows 的零宽收起保留其固定 caption 控件，该座在那里挂载会出现第二组控件）。座位于框架左上角（left 88px 避开 hiddenInset 红绿灯，top 11px 让 28px 控件对齐会话标题行中线，z-index 15 高于列内容、低于框架浮层），并带 `-webkit-app-region: no-drag`，把自己从下方任何拖拽带中减去。
+
+在同一收起条件下框架发布 `--dsh-frame-leading-clearance: 160px`——红绿灯加座内两个控件占据的行内带宽，自框架左边缘起量。窗口全屏隐藏红绿灯（桌面 preload 把状态镜像到 `html[data-fullscreen]`）：座移入其空出的带宽（`left: 12px`），避让量降到 `84px`。会话标题行是唯一消费者：它 pad `max(0px, clearance - 20px)`（其头部已 pad 20px）。两种侧栏状态下都始于窗口顶带之下的入口页（插件管理器页头）改用 `--dsh-frame-top-clearance`（48px，darwin 框架上无条件发布）做顶部内边距，纵向避开顶带而非行内缩进。
+
+ui-sidebar 把 `HeaderLeadingControls` 改注册到 `shell.leading` 而非会话座，复用 shell 的 inject face 与 locale；因挂载条件归框架所有，组件无条件渲染，其平台判断与 CSS 收起门控被删除，同时解除 ui-sidebar 对 ui-conversation 的依赖。原 `conversation.session.header.leading` slot 按 pre-stable API 规则不复存在（更新所有消费者，不留兼容垫层）；会话头现在自带无会话可用的 `conversation.header.leading` 座（root 作用域、无 Session 也渲染）作为公开扩展点，因窗口 chrome 控件已住进 `shell.leading`，出厂组合中它保持空置。
+
+## Alternatives considered
+
+**保留会话座并为每个面板各加一个。** 每个主面板都要重复座标记、拖拽区减除与红绿灯几何，漏掉的面板会让收起的窗口失去重新打开控件。框架持有的单一座使该保证成为结构性的。
+
+**始终挂载占用方、由 CSS 控制可见性（先前机制）。** 它在所有平台与所有收起状态下都保留死 DOM 和头部的 no-drag 减除，且完全帮不到非会话面板。框架级 TSX 挂载把条件、座几何与避让量发布集中在一个文件。
+
+**同时以右栏全屏为座的门控条件。** 不必要：全屏右面板（z-index 40）在视觉上盖住座（15），且它已让整个盒子退出窗口拖拽，座的几何无法穿透它。
+
+**把避让量作为各消费者硬编码的固定内边距。** 各面板写死 `160px` 会与座的真实带宽悄然失同步；在恰为挂载条件下发布一个自定义属性，几何变化时消费者仍保持正确。
+
+## Consequences
+
+- 侧边栏隐藏时，现有与未来的每个主面板都免费获得重新打开与 New Session 控件；会话接入 `--dsh-frame-leading-clearance`，入口页改用无条件发布的 `--dsh-frame-top-clearance`。
+- `conversation.session.header.leading` 从客户端目录中消失；`shell.leading` 作为公开 root 作用域座承载窗口 chrome，会话头无会话可用的 `conversation.header.leading` 则是另一个公开座，出厂组合中无占用者。
+- ui-sidebar 不再依赖 ui-conversation（inject 列表、devDependency 与 tsconfig 引用均已移除）。
+- 挂载条件显式点名 darwin：Windows 的 `data-windows-titlebar` 收起同样得到零宽列，但保留自己的固定 caption 控件，框架座会与之重复。未来某平台若隐藏整列且不留自己的 chrome，通过放宽该条件接入。
+
+## Testing
+
+ui-layout 的 app-frame spec 钉住 darwin 收起下座的挂载/卸载及 56px 控制栏旁座的缺席；apply spec 钉住五 slot 声明与拆除。ui-sidebar 的 apply spec 钉住 `shell.leading` 注册（组件、locale、共享 inject face）及 dispose 时的移除；sidebar-root spec 钉住两个控件的动作。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml
similarity index 55%
rename from .agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.i18n.yaml
rename to .agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml
index 97d7d9c32f..f625fbdf15 100644
--- a/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.md
-2026-09-15-desktop-profile-core-cleanup.md: da189664e2b55a9310b36ed02f0b275e2c1b1370
-2026-09-15-desktop-profile-core-cleanup.zh.md: dec12e4fe7f34beb5931961183041c3f642b44ae
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md
+2026-09-19-profile-resolution-lookup-order.md: da9c501cff6c902863def6d39e4052097c75bcb3
+2026-09-19-profile-resolution-lookup-order.zh.md: 72a9e876a49770ed2bdc544e2ee9104619eedc80
diff --git a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md
new file mode 100644
index 0000000000..da9c501cff
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md
@@ -0,0 +1,141 @@
+# Agent Note: Resolve profile modules along the ancestor chain with an interception layer
+
+Status: implemented
+
+English | [中文](2026-09-19-profile-resolution-lookup-order.zh.md)
+
+## Problem
+
+A profile loads plugins from its own package project. The dsh installation packages and the dependencies embedded in bundles are not on the profile's dependency tree, so Node's default `node_modules` lookup starting from the profile cannot find them.
+
+A developer must be able to restate the resolution rule in one sentence: which part is ordinary Node behavior, which part is dsh's intervention, and where that intervention ends. The previous runtime implementation hid the whole `$DSH_HOME/profiles/node_modules` layer for every package name and kept dedicated recognition code for historical directory layouts, so the rule could not be stated in one sentence and nobody could judge whether a given resolution result was expected.
+
+## Decision
+
+Module resolution inside a profile is an ordinary Node ancestor `node_modules` chain. dsh does exactly one thing: every package name in the runtime resolution computed at startup occupies the package directory position `$DSH_HOME/profiles/node_modules/<package>`. When the chain reaches this layer, a package name with an entry is answered by the runtime resolution's package, and a package name without an entry sees the physical directory at this layer. Every other resolution behavior matches Node. [Construction, publication, Worker inheritance, and runtime carriers of immutable generations](2026-09-09-profile-resolution-generations.md) are recorded by the existing Note and are not repeated here.
+
+### Part 1: Resolution rules
+
+#### 1. The ancestor chain: Node's ancestor `node_modules` lookup
+
+The importer is the module file that issues the `import` or `require`. Node starts from the importer's directory, tries the `node_modules` under each directory level upward until the filesystem root, and then tries `NODE_PATH` and the global directories. The nearest layer wins; within one layer, matching is by package name only.
+
+Symlinks are followed to their real path per Node's default behavior. Once a module is loaded by its real path, the ancestor chain for its subsequent imports is the real path's ancestor chain, regardless of where it was linked from.
+
+The chain below defines the numbering that every table in this Note references. The importer is `$DSH_HOME/profiles/web/node_modules/my-plugin/index.js`:
+
+```text
+① $DSH_HOME/profiles/web/node_modules/my-plugin/node_modules
+② $DSH_HOME/profiles/web/node_modules
+③ $DSH_HOME/profiles/node_modules
+④ $DSH_HOME/node_modules
+⑤ /node_modules
+```
+
+① holds the plugin's private dependencies, ② the packages the profile installed, ③ the interception layer where the runtime resolution occupies the package directories it has entries for, ④ the Harness home, and ⑤ the filesystem root followed by `NODE_PATH` and the global directories.
+
+#### 2. The interception layer: the runtime resolution occupies `$DSH_HOME/profiles/node_modules/<package>`
+
+The interception layer is the first ancestor `node_modules` above the importer's profile directory (`$DSH_HOME/profiles/<name>`). For every profile inside the tree this layer is `$DSH_HOME/profiles/node_modules`.
+
+Every package name in the runtime resolution occupies the package directory position `<interception layer>/<package>` at this layer. For an installation package name such as `@deepseek-ai/dsh-tools`, the package directory at ③ is the copy of the running installation; an old link or old directory of the same name on disk is no longer a member of the chain. For a package name absent from the runtime resolution, the package directory at ③ is the physical content on disk.
+
+The order for one bare package name request: the ancestor chain first walks the layers inside the profile directory (① and ②), and when a candidate exists Node resolves inside that candidate and returns. On reaching ③, if the runtime resolution has an entry for that package name, Node resolves inside the package directory the entry records; a hit returns, and a missing file inside the package continues per Node's own handling of a "found package": CommonJS keeps looking for the subpath layer by layer from ④, ESM fails immediately. If the runtime resolution has no entry, Node looks at the physical directory at ③ and then moves on to ④.
+
+Node remains responsible for `exports`, `imports`, conditions, `main`, subpaths, extensions, caching, and error codes. When the selected package rejects a subpath through `exports`, the error is final; Node does not switch to another package of the same name.
+
+The interception layer reads, writes, and deletes no disk links. Leftover historical symlinks are treated as ordinary filesystem content: the positions of installation package names at ③ are already occupied by the runtime resolution, so old links are never read; all other package names see the contents of ③ normally along the ancestor chain. Profile load removes, once, the projections the link backend of the dsh 0.1.5 releases wrote into a profile: symlinks under the profile's `node_modules` whose target lies inside `<profile>/.dsh-module-fallback/node_modules`, followed by that directory. pnpm-installed packages and every other symlink stay.
+
+#### 3. What the interception layer holds: the runtime resolution's scan contents
+
+The runtime resolution is computed once at profile startup and consists of three parts.
+
+- Installation closure: starting from the `package.json` of the currently running dsh package, a breadth-first traversal follows `dependencies` and `peerDependencies`; each edge resolves from the manifest that declares it per Node rules, and the first installed package found owns a package name. The closure holds several hundred entries, roughly half in the `@deepseek-ai/` scope and half third-party libraries. These entries apply to every profile.
+- Bundle-only entries: for a bundle selected by the profile that is not part of the closure, the same traversal starts from its manifest, and package names the closure already owns are not overridden. These entries apply only to profiles that select that bundle; they let the Loader import the bundle's embedded plugins by bare name from the profile root.
+- Local package names: package names among the profile's direct dependencies that are already installed in `$DSH_HOME/profiles/<name>/node_modules`. They already sit at ② on the ancestor chain; recording them only saves one directory probe.
+
+The CLI derives the installation anchor from `import.meta.url`, which Node has already resolved to its real path; the Desktop Host builds it from its runtime directory, which is not a symlink. Both leave the installation root equal to its real directory, so bundle discovery and dependency traversal use the same location. During the traversal, every dependency level uses the real directory of its owning package as the lookup anchor for the next level and records the location of the manifest that declares it. After a hit, Node resolves from that declaring location and gets the same result the package's own internal imports get. Every entry records the package name, package directory, version, declaring location, and scope. Declared but uninstalled dependencies are skipped; the bundle package root itself does not become an entry.
+
+#### 4. Hook coverage
+
+The hook participates only when the importer is under `$DSH_HOME/profiles/**`. Builtin, relative-path, absolute-path, and URL requests, and every request whose importer is outside the tree, go straight to Node.
+
+The ESM and CommonJS adapters call the same routing function, and the main thread and Harness-owned Workers install the same runtime resolution. The implementation lives in `packages/boot/app-boot/src/profile-resolution/resolver.ts`; runtime resolution construction lives in `packages/boot/app-boot/src/profile.ts`.
+
+### Part 2: Walkthroughs
+
+#### Table 1: Ancestor chain and interception for ESM and CommonJS across request forms
+
+The table uses the installation package `@deepseek-ai/dsh-tools` (has a runtime resolution entry) and the third-party library `left-pad` (no runtime resolution entry) as examples; `pkg` stands for either.
+
+| Request form | ESM | CommonJS | Position of the package name at ③ | When a file is missing inside the package |
+|---|---|---|---|---|
+| Bare name `pkg`, package has `exports` | If ① or ② has a `pkg` directory, Node takes the entry point from its `exports` | Same as ESM; a candidate directory at ① or ② whose entry file is missing does not count as a candidate | With entry: the runtime resolution's package; without entry: the physical directory | A missing entry point under `exports` is an `exports` error, final |
+| Bare name `pkg`, package has no `exports` | As above, entry point from `main` or `index` | As above | As above | ESM fails, final; CommonJS continues looking for an entry point at the next layer |
+| Subpath `pkg/sub`, package has `exports` | The first `pkg` found decides; if `./sub` is not exported, `ERR_PACKAGE_PATH_NOT_EXPORTED` is final | Same as ESM | As above | Final; no other copy is searched |
+| Subpath `pkg/sub`, package has no `exports` | If the first `pkg` found has no `sub`, `ERR_MODULE_NOT_FOUND` is final | Tries `<layer>/pkg/sub` layer by layer: ① and ②, then the position of the package name at ③ (the runtime resolution's package directory when an entry exists), then ④ | As above | ESM final; CommonJS continues to the next layer, that is ④ |
+| `#alias` package-internal alias | After the owning manifest's `imports` maps it to a bare name, handled per the rows above; a mapping to a relative path goes straight to Node | Same as ESM, with conditions from the caller or the defaults | Same as the matching row | Same as the matching row |
+| `require.resolve(pkg, { paths })` | No such form | Applies the same rule to each item in `paths` independently: an item inside the profile tree walks ① and ②, ③, ④ from that item; an item outside the tree goes to Node; in the caller's order | As above | The item continues to its next layer, then the next item takes its turn |
+| Package self-reference (the importer's package imports by its own `name`) | Goes to Node with the original importer kept | Same as ESM | Not involved | Not applicable |
+| Relative / absolute / URL / builtin | Goes to Node | Goes to Node | Not involved | Not applicable |
+
+After a runtime resolution hit, the `ERR_MODULE_NOT_FOUND` and `ERR_PACKAGE_PATH_NOT_EXPORTED` errors Node reports replace the internal declaring location with the original importer; the CommonJS require stack also drops the internal anchor.
+
+#### Table 2: Interception position for the Web and Desktop profiles
+
+| profile | Directory | Interception layer | Difference from web |
+|---|---|---|---|
+| web | `$DSH_HOME/profiles/web` | `$DSH_HOME/profiles/node_modules` | Baseline |
+| desktop | `$DSH_HOME/profiles/desktop` | `$DSH_HOME/profiles/node_modules` | None. Same tree, same layer; the Desktop Host runs the same resolver in Node mode |
+| Out-of-tree profile | Any directory `loadProfileDirectory` accepts | The first ancestor `node_modules` above that directory | Same rule; no product currently uses an out-of-tree profile, only unit tests cover it |
+
+#### Table 3: Ancestor chain when a plugin is linked outside the tree
+
+| Import source → target | Hook participates | Result |
+|---|---|---|
+| profile → linked plugin | Participates up to ② | Node follows the symlink at ②; the plugin loads by its real path |
+| Linked plugin → its own third-party dependencies | Does not participate | The real path's ancestor chain; uses the version in the developer's own `node_modules` |
+| Linked plugin → dsh installation packages | Does not participate | The copy in the developer's own `node_modules`; `ERR_MODULE_NOT_FOUND` when absent. Part 3 describes how to make it the same copy as the running dsh |
+
+### Part 3: Developer integration guide
+
+#### 1. Normal installation
+
+`dsh plugin --profile <name> add <package | git spec | file:../local-checkout>` forwards its argument to pnpm, which installs inside the profile directory with a hoisted layout. The profile's `pnpm-workspace.yaml` sets `autoInstallPeers: false`, so dsh packages a plugin declares as peers are not installed into the profile; the interception layer supplies the copy from the running installation, and the plugin and dsh share one module instance.
+
+The plugin's own third-party dependencies are hoisted to `$DSH_HOME/profiles/<name>/node_modules` and found at ② on the ancestor chain. When a name collides with the installation closure, the nearest wins and the plugin uses the version it declared. The `file:` form copies the local checkout into the profile; resolution afterwards is identical to a registry installation.
+
+#### 2. Development mode: the plugin repository is outside the profile tree
+
+`npm link`, or a bare directory path such as `dsh plugin add ../my-plugin` (which pnpm treats as `link:`), makes the entry in the profile a symlink to the plugin repository. The plugin loads by its real path and the hook takes no part in its imports. The plugin repository's own dependency tree must resolve dsh installation packages to the same copy as the running dsh; both layouts below satisfy this.
+
+- Layout A: the plugin repository installs `@deepseek-ai/dsh` and the `@deepseek-ai/dsh-*` peers the plugin uses as devDependencies and starts with the dsh in that repository, for example `pnpm exec dsh --profile <name>`. The running installation is the copy on the plugin's ancestor chain, so the runtime resolution and the real paths agree.
+- Layout B: the plugin repository links the dsh packages it uses to the local dsh source repository (`link:../deepseek-harness/packages/core/tools` or `pnpm link`) and starts `pnpm dsh --profile <name>` from the source repository. Both sides load the same copy from the source repository.
+
+Not provided and not recommended: having the hook proxy installation packages for real paths linked out of the tree, which requires tracking every real root entered from the profile, something Node itself does not do for developers either; and starting with a dsh installed elsewhere while the plugin repository installs its own dsh devDependencies, which produces two module instances and splits both `Symbol()` keys and `instanceof` checks.
+
+## Alternatives considered
+
+**Let the runtime resolution act only as a fallback after the whole ancestor chain is exhausted.** The ancestor chain would first read a leftover historical installation link at ③ and use it, which conflicts with "installation packages come from the running installation". The runtime resolution must occupy the positions of installation package names at ③.
+
+**Treat the runtime resolution as a whole layer inserted into the ancestor chain instead of occupying package directories at ③.** The two differ in exactly one place: when CommonJS hits a runtime resolution package and the subpath is missing, the former would go back and read the old copy of the same name at ③, while the latter goes straight to ④ per Node's handling of a "found package". Occupying the package directory matches Node semantics and needs no extra check for ③.
+
+**Give installation closure entries absolute priority over nearer copies.** The closure contains 281 third-party libraries. A plugin's private versions of `zod`, `yaml`, and others would be overridden by the versions in the installation closure, breaking the nearest-wins rule shared with Node. The supported installation flow no longer installs dsh peers into the profile, so overriding is not needed to guarantee a single instance.
+
+**Recognize and bypass symlinks in the `.dsh-module-fallback` layout at resolve time.** This keeps dedicated logic in the lookup path for directories that are no longer produced, and every resolution pays for it. Removing those projections once at profile load reaches the same result: after a bundle is deselected while it stays installed, its projected plugin no longer shadows the same-named plugin the runtime resolution selects from another bundle.
+
+**Hide the whole physical directory that holds the interception layer.** This conflicts with "all other resolution matches Node": non-installation packages placed in `$DSH_HOME/profiles/node_modules` would become invisible to every profile.
+
+**Extend the hook to the real directories of plugins linked outside the tree.** This requires tracking every real root entered from the profile during resolution and rewriting results for some package names under those directories; Node does this for no linked-out package, and the two layouts in Part 3 do not need it.
+
+## Verification
+
+- The table-driven matrix in [profile-resolution.spec.ts](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts): importers are the profile root and a plugin inside the profile; package names are an installation entry, a bundle-only entry, and a name outside the table; every presence combination of the four layers ①②③④, with ② and ③ each in two forms, a real directory and a symlink pointing elsewhere; every cell asserts that ESM import, CommonJS require, `require.resolve`, and the `packageDir` metadata land in the same directory.
+- Dedicated cases in the same file cover each row of Table 1: bare names and subpaths with and without `exports`, `#alias`, explicit `paths`, package self-reference, CommonJS skipping ③ and going straight to ④ when a subpath is missing after a runtime resolution hit, and the interception position of an out-of-tree profile.
+- The [real CLI launch test](../../../../apps/cli/tests/profiles/headless/tests/profile-resolution.ts), under src and lib launches and under plain-directory and npm-link layouts, places an old `@deepseek-ai/dsh-tools` link at ③ and an external package with its embedded dependency at ③, and asserts that Tools and AgentLoop share one module instance, that the external package resolves along its real path, and that every file and link target stays byte-identical.
+
+## Consequences
+
+Gained: startup writes nothing to disk; installation packages always come from the running installation; all other resolution matches Node, so developers can predict results with their Node knowledge; no recognition code exists for any historical directory layout.
+
+Paid: third-party libraries in the installation closure still occupy package directories at ③, so a profile plugin that declares a third-party library as a peer or omits the declaration gets the version dsh uses internally, as in the disk-link era; plugins should declare third-party libraries as dependencies. Plugins linked outside the tree cannot obtain installation packages through the hook and must align themselves using the layouts in Part 3. Consumers that bypass the hook, namely child processes a plugin spawns itself, third-party Workers, and external tools run inside the profile directory, can no longer find installation packages through disk links in `$DSH_HOME/profiles/node_modules`. The resolver continues to depend on supported Node Internal interfaces.
diff --git a/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md
new file mode 100644
index 0000000000..72a9e876a4
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md
@@ -0,0 +1,141 @@
+# Agent Note: profile 解析的主线祖先链与拦截层
+
+Status: implemented
+
+[English](2026-09-19-profile-resolution-lookup-order.md) | 中文
+
+## Problem
+
+profile 从自己的包项目加载插件。dsh 本体包和 bundle 内嵌的依赖不在 profile 的依赖树上，Node 默认的 `node_modules` 查找从 profile 出发找不到它们。
+
+解析规则需要能被开发者一句话复述：哪一段是普通 Node 行为，哪一段是 dsh 的干预，干预的范围到哪里为止。此前的运行时实现把 `$DSH_HOME/profiles/node_modules` 整层对所有包名隐藏，又为历史目录形状保留了专门的识别代码，规则无法用一句话说清，也无法判断某次解析结果是否符合预期。
+
+## Decision
+
+profile 内模块的解析是一条普通的 Node 祖先 `node_modules` 链。dsh 只做一件事：启动时算出的 runtime resolution 中的每个包名，占据 `$DSH_HOME/profiles/node_modules/<包名>` 这个包目录的位置。链走到这一层时，有条目的包名由 runtime resolution 的包回答，没有条目的包名看这一层的物理目录。除此之外的一切解析行为与 Node 一致。[不可变 generation 的构造、发布、Worker 继承与运行时载体](2026-09-09-profile-resolution-generations.zh.md)由既有 Note 记录，本篇不复述。
+
+### 一、解析规则
+
+#### 1. 主线：Node 的祖先 `node_modules` 链
+
+importer 指发起 `import` 或 `require` 的那个模块文件。Node 从 importer 所在目录开始，逐层向上尝试每一级目录下的 `node_modules`，直到文件系统根，再尝试 `NODE_PATH` 与全局目录。最近的一层优先；同一层内只按包名匹配。
+
+软链接按 Node 默认行为跟随到真实路径。一个模块一旦以真实路径加载，它后续 import 的主线就是真实路径的祖先链，与它被链接到哪里无关。
+
+下面这条链是全文表格引用的编号。importer 为 `$DSH_HOME/profiles/web/node_modules/my-plugin/index.js`：
+
+```text
+① $DSH_HOME/profiles/web/node_modules/my-plugin/node_modules
+② $DSH_HOME/profiles/web/node_modules
+③ $DSH_HOME/profiles/node_modules
+④ $DSH_HOME/node_modules
+⑤ /node_modules
+```
+
+① 是插件私有依赖，② 是 profile 安装的包，③ 是拦截层，runtime resolution 占据其中有条目的包目录，④ 是 Harness home，⑤ 是文件系统根，随后是 `NODE_PATH` 与全局目录。
+
+#### 2. 拦截层：runtime resolution 占据 `$DSH_HOME/profiles/node_modules/<包名>`
+
+拦截层是 importer 所属 profile 目录（`$DSH_HOME/profiles/<name>`）之上的第一个祖先 `node_modules`。树内所有 profile 的这一层都是 `$DSH_HOME/profiles/node_modules`。
+
+runtime resolution 中的每个包名，在这一层上占据 `<拦截层>/<包名>` 这个包目录的位置。对 `@deepseek-ai/dsh-tools` 这样的本体包名，③ 上的包目录就是运行中安装的那一份；磁盘上同名的旧链接或旧目录不再是链上的成员。对 runtime resolution 没有的包名，③ 上的包目录就是磁盘上的物理内容。
+
+一次裸包名请求的顺序：主线先走完 profile 目录内部的各层（①②），有候选就交给 Node 在候选内解析并返回。走到 ③ 时，runtime resolution 有该包名的条目，Node 就在条目记录的包目录内解析；找到就返回，包内缺文件则按 Node 自身对"已找到包"的处理继续，CommonJS 从 ④ 继续逐层找子路径，ESM 直接报错。runtime resolution 没有条目，Node 就看 ③ 的物理目录，再到 ④。
+
+Node 仍然负责 `exports`、`imports`、conditions、`main`、子路径、扩展名、缓存与错误码。被选中的包因 `exports` 拒绝某个子路径时报错终局，不会换另一个同名包。
+
+拦截层不读、不写、不删任何磁盘链接。历史残留的软链接一律按普通文件系统内容处理：本体包名在 ③ 上的位置已被 runtime resolution 占据，旧链接永远不会被读到；其余包名按主线正常看到 ③ 里的内容。profile 加载时一次性删除 dsh 0.1.5 系列发布版的 Link 后端写进 profile 的投影：profile `node_modules` 下目标位于 `<profile>/.dsh-module-fallback/node_modules` 内的软链接，以及该目录本身。pnpm 安装的包和其他软链接都保留。
+
+#### 3. 拦截层里有什么：runtime resolution 的扫描内容
+
+runtime resolution 在 profile 启动时一次算出，由三部分组成。
+
+- installation 闭包：从当前运行的 dsh 包的 `package.json` 出发，沿 `dependencies` 与 `peerDependencies` 做广度优先遍历，每条边从声明它的 manifest 按 Node 规则解析，同一个包名由第一次找到的已安装包占有。闭包有数百条，约一半在 `@deepseek-ai/` 作用域，一半是第三方库。这些条目对所有 profile 生效。
+- bundle-only 条目：profile 选中的、不属于闭包的 bundle，从它的 manifest 出发做同样的遍历，闭包已占有的包名不覆盖。这些条目只对选中该 bundle 的 profile 生效，用于让 Loader 从 profile 根按裸名导入 bundle 内嵌的插件。
+- 本地包名：profile 直接依赖中已经安装在 `$DSH_HOME/profiles/<name>/node_modules` 的包名。它们本来就在主线 ② 上，记录下来只为免去一次目录探测。
+
+CLI 的安装锚点来自 `import.meta.url`，Node 已对它做过 realpath；Desktop Host 从其运行时目录拼出锚点，该目录不是软链接。两者的安装根目录都等于真实目录，bundle 发现与依赖遍历使用同一个位置。遍历中每一层依赖都以所属包的真实目录作为下一层的查找锚点，并记录声明它的 manifest 位置。命中后 Node 从这个声明位置解析，得到与该包自己内部 import 相同的结果。每个条目记录包名、包目录、版本、声明位置与作用域。已声明但未安装的依赖跳过；bundle 包根自身不成为条目。
+
+#### 4. hook 覆盖范围
+
+hook 只在 importer 位于 `$DSH_HOME/profiles/**` 时参与。builtin、相对路径、绝对路径、URL 请求，以及 importer 在树外的一切请求，直接交给 Node。
+
+ESM 与 CommonJS 两个适配器调用同一个路由函数，主线程与 Harness 自有 Worker 都安装同一份 runtime resolution。实现位于 `packages/boot/app-boot/src/profile-resolution/resolver.ts`，runtime resolution 的构造位于 `packages/boot/app-boot/src/profile.ts`。
+
+### 二、预演
+
+#### 表 1：ESM 与 CommonJS 在各类请求下的主线与拦截
+
+下表以本体包 `@deepseek-ai/dsh-tools`（runtime resolution 有条目）和第三方库 `left-pad`（runtime resolution 无条目）为例；`pkg` 泛指两者。
+
+| 请求形态 | ESM | CommonJS | ③ 上该包名的位置 | 包内缺文件时 |
+|---|---|---|---|---|
+| 裸包名 `pkg`，包有 `exports` | ①② 有 `pkg` 目录则 Node 在其中按 `exports` 取入口 | 同 ESM；①② 的候选目录缺入口文件时不算候选 | 有条目：runtime resolution 的包；无条目：物理目录 | 有 `exports` 的入口缺失是 `exports` 错误，终局 |
+| 裸包名 `pkg`，包无 `exports` | 同上，入口取 `main` 或 `index` | 同上 | 同上 | ESM 终局报错；CommonJS 从下一层继续找入口 |
+| 子路径 `pkg/sub`，包有 `exports` | 第一个找到的 `pkg` 决定；`./sub` 未导出则 `ERR_PACKAGE_PATH_NOT_EXPORTED` 终局 | 同 ESM | 同上 | 终局，不找别的副本 |
+| 子路径 `pkg/sub`，包无 `exports` | 第一个找到的 `pkg` 内没有 `sub` 则 `ERR_MODULE_NOT_FOUND` 终局 | 逐层尝试 `<层>/pkg/sub`：①②，然后 ③ 上该包名的位置（有条目即 runtime resolution 的包目录），然后 ④ | 同上 | ESM 终局；CommonJS 继续下一层，即 ④ |
+| `#alias` 包内别名 | 所属 manifest 的 `imports` 映射到裸包名后，按上面各行处理；映射到相对路径则直接交 Node | 同 ESM，conditions 取调用方传入或默认值 | 同对应行 | 同对应行 |
+| `require.resolve(pkg, { paths })` | 无此形式 | 对 `paths` 中每一项独立套用同一规则：项在 profile 树内则从该项出发走 ①②、③、④；项在树外交 Node；按调用方给出的顺序 | 同上 | 该项继续下一层，再轮到下一项 |
+| 包自引用（importer 所属包按自己的 `name` import） | 交 Node，保留原 importer | 同 ESM | 不参与 | 不适用 |
+| 相对 / 绝对 / URL / builtin | 交 Node | 交 Node | 不参与 | 不适用 |
+
+命中 runtime resolution 后，Node 报出的 `ERR_MODULE_NOT_FOUND` 与 `ERR_PACKAGE_PATH_NOT_EXPORTED` 会把内部的声明位置替换回原 importer；CommonJS 的 require stack 也去掉内部锚点。
+
+#### 表 2：Web 与 Desktop 两种 profile 的拦截位置
+
+| profile | 目录 | 拦截层 | 与 web 的差异 |
+|---|---|---|---|
+| web | `$DSH_HOME/profiles/web` | `$DSH_HOME/profiles/node_modules` | 基准 |
+| desktop | `$DSH_HOME/profiles/desktop` | `$DSH_HOME/profiles/node_modules` | 无。同一棵树、同一层；Desktop 的 Host 以 Node 模式运行同一套 resolver |
+| 树外 profile | `loadProfileDirectory` 接受的任意目录 | 该目录之上的第一个祖先 `node_modules` | 规则相同；当前没有产品使用树外 profile，只有单元测试覆盖 |
+
+#### 表 3：插件被 link 到树外时的主线
+
+| import 来源 → 目标 | hook 是否参与 | 结果 |
+|---|---|---|
+| profile → 链接的插件 | 参与到 ② 为止 | ② 的软链接被 Node 跟随，插件以真实路径加载 |
+| 链接插件 → 它自己的第三方依赖 | 不参与 | 真实路径的祖先链，使用开发者自己 `node_modules` 里的版本 |
+| 链接插件 → dsh 本体包 | 不参与 | 开发者自己 `node_modules` 里的副本；没有则 `ERR_MODULE_NOT_FOUND`。让它与运行中的 dsh 是同一份的做法见第三章 |
+
+### 三、开发者接入指引
+
+#### 1. 正常安装
+
+`dsh plugin --profile <name> add <包名 | git spec | file:../本地检出>` 把参数转发给 pnpm，在 profile 目录内以 hoisted 布局安装。profile 的 `pnpm-workspace.yaml` 设置 `autoInstallPeers: false`，插件声明为 peer 的 dsh 包不会被装进 profile，由拦截层提供当前运行安装的那一份，插件与 dsh 共用同一个模块实例。
+
+插件自己的第三方依赖被 hoist 到 `$DSH_HOME/profiles/<name>/node_modules`，按主线 ② 找到。与 installation 闭包同名时最近者优先，插件使用自己声明的版本。`file:` 形式把本地检出复制进 profile，随后的解析与注册表安装完全相同。
+
+#### 2. 开发模式：插件仓库在 profile 树外
+
+`npm link`，或 `dsh plugin add ../my-plugin` 这类裸目录路径（pnpm 按 `link:` 处理），会让 profile 里的条目成为指向插件仓库的软链接。插件以真实路径加载，hook 不参与它的 import。dsh 本体包必须由插件仓库自己的依赖树解析到与运行中 dsh 同一份，两种布局都满足这一点。
+
+- 布局 A：插件仓库把 `@deepseek-ai/dsh` 以及插件用到的 `@deepseek-ai/dsh-*` peer 装成 devDependency，并用该仓库里的 dsh 启动，例如 `pnpm exec dsh --profile <name>`。运行中的安装就是插件祖先链上的那一份，两者的 runtime resolution 与真实路径一致。
+- 布局 B：插件仓库把用到的 dsh 包 link 到本机的 dsh 源码仓（`link:../deepseek-harness/packages/core/tools` 或 `pnpm link`），并从源码仓启动 `pnpm dsh --profile <name>`。两边加载的都是源码仓里的同一份。
+
+不提供、不建议的做法：由 hook 为 link 出去的真实路径代理本体包，这需要追踪从 profile 进入的每个真实根目录，Node 自身也不替开发者做这件事；用别处安装的 dsh 启动，同时插件仓库另装一套 dsh devDependency，这会产生两个模块实例，`Symbol()` 键与 `instanceof` 判断都会分裂。
+
+## Alternatives considered
+
+**让 runtime resolution 只在主线全部走完后兜底。** 主线会先在 ③ 读到历史残留的本体链接并使用它，与"本体以当前运行的安装为准"冲突。runtime resolution 必须占据 ③ 上本体包名的位置。
+
+**把 runtime resolution 当作插入主线的一整层，而不是占据 ③ 上的包目录。** 两者只在一处不同：CommonJS 命中 runtime resolution 的包后子路径缺失时，前者会再回头读 ③ 上同名的旧副本，后者按 Node 对"已找到的包"的处理直接到 ④。占据包目录与 Node 语义一致，也不需要为 ③ 保留任何额外判断。
+
+**让 installation 闭包条目绝对优先于更近的副本。** 闭包含 281 个第三方库。插件私有的 `zod`、`yaml` 等版本会被安装闭包里的版本覆盖，破坏与 Node 一致的最近者优先。受支持的安装流程已经不把 dsh 的 peer 装进 profile，不需要再用覆盖来保证单实例。
+
+**在解析时识别 `.dsh-module-fallback` 形状的软链接并绕过。** 这会为不再产生的目录在查找路径里保留专门逻辑，每次解析都要付出判断。在 profile 加载时一次性删除这些投影能得到同样的结果：一个 bundle 被停用但仍装着时，它投影出来的插件不再遮住 runtime resolution 从另一个 bundle 选出的同名插件。
+
+**把拦截层所在的物理目录整层隐藏。** 与"其余解析与 Node 一致"冲突：放在 `$DSH_HOME/profiles/node_modules` 的非本体包会对所有 profile 不可见。
+
+**让 hook 覆盖 link 到树外的插件真实目录。** 需要在解析时追踪每个从 profile 进入的真实根目录，并对这些目录下的部分包名改写结果；Node 不为任何 link 出去的包做这种事，第三章的两种布局不需要它。
+
+## Verification
+
+- [profile-resolution.spec.ts](../../../../packages/boot/app-boot/tests/profile-resolution.spec.ts) 中的表驱动矩阵：importer 取 profile 根与 profile 内插件，包名取 installation 条目、bundle-only 条目与表外包名，①②③④ 四层的每一种有无组合，②③ 各含真目录与指向别处的软链接两种形态；每格断言 ESM import、CommonJS require、`require.resolve` 与 `packageDir` 元数据落在同一个目录。
+- 同一文件内的专项用例覆盖表 1 各行：有无 `exports` 的裸包名与子路径、`#alias`、显式 `paths`、包自引用、命中 runtime resolution 后 CommonJS 子路径缺失时跳过 ③ 直接到 ④，以及树外 profile 的拦截位置。
+- [CLI 真启动测试](../../../../apps/cli/tests/profiles/headless/tests/profile-resolution.ts)在 src 与 lib 两种启动、普通目录与 npm-link 两种布局下，放置 ③ 的旧 `@deepseek-ai/dsh-tools` 链接、③ 的外部包及其内嵌依赖，断言 Tools 与 AgentLoop 共用同一模块实例、外部包沿真实路径解析、所有文件与链接目标逐字节不变。
+
+## Consequences
+
+买到的：启动不写盘；本体包永远来自当前运行的安装；其余解析与 Node 一致，开发者可以用 Node 的知识预测结果；没有针对任何历史目录形状的识别代码。
+
+付出的：installation 闭包里的第三方库仍占据 ③ 上的包目录，profile 插件把第三方库声明成 peer 或漏声明时会拿到 dsh 内部使用的版本，与磁盘链接时代相同，插件应把第三方库声明成 dependency；link 到树外的插件不能通过 hook 拿到本体包，必须按第三章的布局自行对齐；不经过 hook 的消费者，即插件自己 spawn 的子进程、第三方 Worker、在 profile 目录里运行的外部工具，不再能通过 `$DSH_HOME/profiles/node_modules` 的磁盘链接找到本体包；resolver 继续依赖受支持的 Node Internal 接口。
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.md b/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.md
deleted file mode 100644
index da189664e2..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Agent Note: Clean application-owned packages before Desktop production boot
-
-Status: implemented
-
-English | [中文](2026-09-15-desktop-profile-core-cleanup.zh.md)
-
-## Problem
-
-Old Desktop profiles contain installed core packages and local tarball dependency declarations. Local package precedence can combine an old Web frontend with new plugins even when the application carries a consistent release. Development fallback links also remain when users switch to an installed application.
-
-## Decision
-
-Production Desktop cleans profile copies of packages named in the verified runtime descriptor or the old Desktop package-set record before starting the Host, under the existing profile lock. Cleanup removes matching dependency declarations and pnpm overrides, invalidates the lockfile when package state changes, and unlinks fallback links without deleting their targets. Other plugins, bundle selections, configuration, and session data remain. Development skips cleanup.
-
-The implementation and its temporary enable constant live in `apps/desktop/src/profile-core-cleanup.ts`, with one call in profile preparation. Cleanup runs on every production startup because development or package operations can recreate residue. This qualifies package retention in the [bundled runtime decision](../architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.md); direct writes and failure recovery remain unchanged.
-
-## Alternatives considered
-
-**Installer-only cleanup** misses other user profiles and packages recreated after installation; both platforms use startup cleanup.
-
-**Deleting every organization-prefixed package** can remove optional official plugins. Explicit current and historical package inventories determine ownership.
-
-**Deleting package directories alone** lets pnpm reinstall the same old packages from retained declarations and overrides.
-
-## Consequences
-
-Production loses profile-local overrides of application-owned packages. A changed profile loses its lockfile and the next pnpm operation resolves remaining plugin dependencies again. Cleanup does not run pnpm or create rollback state; failures stop preparation and can be retried. Redirected package-parent directories fail before deletion. Focused tests cover retained plugins, declarations, repeated cleanup, development exclusion, retired packages, invalid records, and link targets.
diff --git a/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.zh.md b/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.zh.md
deleted file mode 100644
index dec12e4fe7..0000000000
--- a/.agents/notes/implemented/bug-fix/2026-09-15-desktop-profile-core-cleanup.zh.md
+++ /dev/null
@@ -1,27 +0,0 @@
-# Agent Note: 在 Desktop 生产启动前清理应用管理的包
-
-Status: implemented
-
-[English](2026-09-15-desktop-profile-core-cleanup.md) | 中文
-
-## Problem
-
-旧 Desktop profile 包含已安装的核心包及本地 tarball 依赖声明。即使应用携带一致的发布产物，本地包优先规则仍可能把旧 Web 前端与新插件组合起来。用户切换到已安装应用时，开发模式的回退链接也会残留。
-
-## Decision
-
-生产版 Desktop 在启动 Host 前，持有现有 profile 锁，清理已验证运行时描述符或旧 Desktop 包清单记录列出的包副本。清理删除对应依赖声明和 pnpm overrides，在包状态变化时使锁文件失效，并解除回退链接而不删除其目标。其他插件、bundle 选择、配置和会话数据保留。开发模式跳过清理。
-
-实现与临时启用常量集中在 `apps/desktop/src/profile-core-cleanup.ts`，由 profile 准备流程中的一个调用接入。每次生产启动都执行清理，因为开发模式或包操作可能重新产生残留。这限定了[内置运行时决策](../architecture/2026-09-08-desktop-bundled-runtime-and-external-plugins.zh.md)中的包保留范围；直接写入和失败恢复保持不变。
-
-## Alternatives considered
-
-**仅在安装器中清理**会遗漏其他用户的 profile 和安装后重新产生的包；两个平台都在启动时清理。
-
-**删除组织名前缀下的所有包**可能误删可选官方插件。明确的当前及历史包清单决定归属。
-
-**仅删除包目录**会让 pnpm 根据保留的声明和 overrides 重新安装相同旧包。
-
-## Consequences
-
-生产版不再使用 profile 对应用管理包的本地覆盖。发生变化的 profile 丢弃锁文件，下次 pnpm 操作会重新解析其余插件依赖。清理不运行 pnpm，也不创建回滚状态；失败会停止准备流程，之后可以重试。重定向的包父目录会在删除前报错。定向测试覆盖插件保留、声明、重复清理、开发模式排除、退役包、无效记录及链接目标。
diff --git a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml
index f24e9aa057..d15870537e 100644
--- a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md
-2026-09-13-macos-hidden-titlebar-vibrancy.md: 99ac240698fb229f9a0d66a8000251058b52491e
-2026-09-13-macos-hidden-titlebar-vibrancy.zh.md: 26bbb616485e49de2f70a3d142ea84dfd5bd7cb9
+2026-09-13-macos-hidden-titlebar-vibrancy.md: 807c79d06c468e01b8b9df3f18a32e5fbaba1e90
+2026-09-13-macos-hidden-titlebar-vibrancy.zh.md: a521aff7624b1f9dbab18e7d0f02f61af0bdc24a
diff --git a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md
index 99ac240698..807c79d06c 100644
--- a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md
+++ b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md
@@ -18,9 +18,11 @@ Every macOS web-side adjustment keys off `html[data-platform='darwin']`, which o
 
 **Native theme sync.** The vibrancy material follows `nativeTheme.themeSource`, which otherwise tracks the OS appearance and diverges from the app's own theme preference. The ui-theme boot script and ui-layout `ThemePresenter` publish `html[data-ds-theme-source]` (`light`, `dark`, or `system`; a fixed preference, including registered theme ids, publishes its resolved scheme). The app preload observes the attribute and forwards it over `dsh-desktop:native-theme-set`; main validates the value and the sender (the main window's WebContents, including its local static Web document) and assigns `nativeTheme.themeSource`. Publishing the preference rather than the resolved scheme preserves OS-follow while the preference is `system`.
 
-**Sidebar top strip and full hide.** On darwin the sidebar opens with a 52px top strip that clears the traffic lights, carries the collapse toggle, and is a window drag region (`-webkit-app-region: drag`; the toggle opts out). Collapsing the sidebar hides the column entirely — `computeColumns` takes an explicit `collapsedWidth` and the AppFrame passes 0 on darwin desktop — instead of the 56px rail the other platforms keep. The reopen affordances move into the conversation header: a single, root-scoped slot `conversation.header.leading` sits before the breadcrumbs, and ui-sidebar registers `HeaderLeadingControls` (open sidebar + New Session, reusing the shell's inject face and locale) into it. Visibility is pure CSS against the AppFrame-published `data-sidebar-collapsed` attribute; no collapse-state pipe is added. The resident header keeps the leading seat mounted on darwin with or without a selected Session so a hidden sidebar always has a reopen control on screen.
+**Sidebar top strip and full hide.** On darwin the sidebar opens with a 52px top strip that clears the traffic lights and carries the collapse toggle; the frame's `.leadingBand` drag band covers the same 52px geometry, so the strip declares no app-region of its own and the toggle subtracts itself through the base.css interactive rule. Collapsing the sidebar hides the column entirely — `computeColumns` takes an explicit `collapsedWidth` and the AppFrame passes 0 on darwin desktop — instead of the 56px rail the other platforms keep. The reopen affordances live in the frame's root-scoped `shell.leading` window-chrome seat, which the AppFrame mounts only while the column is fully hidden; ui-sidebar registers `HeaderLeadingControls` (open sidebar + New Session, reusing the shell's inject face and locale) into it. The seat placement, the `--dsh-frame-leading-clearance` variable panels pad by, and the removal of the earlier conversation-header seat are owned by the [shell.leading Agent Note](../architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md).
 
-**Drag regions.** The conversation title row is a drag region on darwin with every interactive descendant opted out. Electron computes drag regions from window geometry in DOM order, not stacking: an overlay covering the title band must subtract itself or the band underneath keeps taking the pointer. The right sidebar's fullscreen panel therefore sets `-webkit-app-region: no-drag` on its whole box and restores drag on its tab strips' blank runs.
+**Window fullscreen marker.** macOS fullscreen hides the traffic lights, so layouts built around them must relax. The main process relays `isFullScreen()` over `dsh-desktop:window-fullscreen` on `enter-full-screen`, `leave-full-screen`, and each `did-finish-load`; the app preload's `syncWindowFullscreen()` mirrors it onto `html[data-fullscreen]`. Consumers: the AppFrame drops `--dsh-frame-leading-clearance` to 84px and moves the seat to `left: 12px`, the sidebar's `.topStrip` moves the toggle to the strip's left edge, and the right sidebar's fullscreen panel resets its first pane's dockkit strip inset to the ordinary 10px.
+
+**Drag regions.** Electron computes drag regions from window geometry in DOM order, not stacking, so `-webkit-app-region: drag` is declared only inside the two allowlisted stylesheets: ui-layout `AppFrame.module.css` (the darwin `.leadingBand`, a 52px full-width `pointer-events: none` strip rendered as the frame's first child, and the Windows caption `.frame::before`) and ui-sidebar `SidebarRoot.module.css` (`.logoRow`, which extends the band below 52px). Everything interactive subtracts itself through two global ui-web base.css rules: one `:is(...)` selector opting out every interactive element (buttons, links, inputs, roles, `[tabindex]`), and one `body > :not(#root)` rule covering every overlay portaled beside `#root`. Because the drag bands mount before all content, any later no-drag box wins; content containers never declare drag, which would override earlier-mounted overlays.
 
 **Fullscreen traffic-light clearance.** ui-dockkit publishes the tab strip's start inset as `--dsh-dockkit-strip-inline-start` (fallback the design's own 10px). The right sidebar's fullscreen presentation on darwin sets 88px on the panel body and resets 10px for every non-first split cell's subtree, so exactly the pane touching the window's top-left corner clears the lights at any split depth.
 
@@ -40,10 +42,10 @@ Every macOS web-side adjustment keys off `html[data-platform='darwin']`, which o
 
 - The macOS window gains a translucent sidebar and hidden titlebar at zero cost to other platforms: every rule is scoped to `[data-platform='darwin']`, which only the Electron preload sets.
 - The vibrancy material follows the app theme, including third-party registered themes (their resolved scheme). Screenshots and screen recordings differ from the flat web rendering.
-- `conversation.header.leading` is a public slot in the client catalog; any package can occupy the seat, and ui-sidebar's occupant assumes it may render into it whenever the platform matches.
-- Drag-region geometry is a window-global invariant: any future overlay that covers the title band on darwin must subtract itself with `-webkit-app-region: no-drag` or its controls become unclickable.
+- The reopen controls occupy the frame's `shell.leading` seat, a public slot in the client catalog; the earlier `conversation.session.header.leading` seat is removed ([shell.leading Agent Note](../architecture/2026-09-17-frame-shell-leading-window-chrome-seat.md)).
+- Drag-region ownership is a window-global invariant: `-webkit-app-region: drag` appears only inside the two allowlisted stylesheets (ui-layout `AppFrame.module.css`: darwin `.leadingBand` and Windows caption `.frame::before`; ui-sidebar `SidebarRoot.module.css`: `.logoRow`); other packages rely on the base.css opt-outs or add a scoped `no-drag`, never a new drag surface. The ui-theme app-region stylesheet gate enforces the allowlist over every package stylesheet.
 - The transparent window plus vibrancy is accepted to look different in screen sharing and may flash on startup; the transparent `backgroundColor` mitigates the flash.
 
 ## Testing
 
-ui-theme boot and ui-layout presenter specs pin the `data-ds-theme-source` publication and disposal. The ui-sidebar apply spec pins the leading-seat registration (component, locale, shared inject face) and its removal on teardown. The ui-conversation skeleton spec pins the leading slot's render call with and without a selected Session. The ui-theme corner-shape and full-round style gates cover the new stylesheet.
+ui-theme boot and ui-layout presenter specs pin the `data-ds-theme-source` publication and disposal. The ui-sidebar apply spec pins the `shell.leading` registration (component, locale, shared inject face) and its removal on teardown; the ui-layout app-frame spec pins the seat's darwin mount. The desktop main-startup spec pins the fullscreen relay (transitions, reloads, destroyed-window guard, darwin-only registration) and the preload-platform spec pins the `html[data-fullscreen]` mirror. The ui-theme corner-shape and full-round style gates cover the new stylesheet, and its app-region style gate pins drag-region ownership to the two allowlisted stylesheets across every package stylesheet.
diff --git a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md
index 26bbb61648..a521aff762 100644
--- a/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md
+++ b/.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md
@@ -18,9 +18,11 @@ Electron 主进程在 darwin 上以 `titleBarStyle: 'hiddenInset'`、`trafficLig
 
 **原生主题同步。** 毛玻璃材质跟随 `nativeTheme.themeSource`，后者默认跟踪系统外观，会与应用自身的主题偏好背离。ui-theme 引导脚本与 ui-layout 的 `ThemePresenter` 发布 `html[data-ds-theme-source]`（`light`、`dark` 或 `system`；固定偏好——包括注册主题 id——发布其解析后的配色）。应用 preload 观察该属性并经 `dsh-desktop:native-theme-set` 转发；主进程校验取值与发送者（主窗口的 WebContents，包括其本地静态 Web 文档）后赋给 `nativeTheme.themeSource`。发布偏好而非解析值，可在偏好为 `system` 时保留跟随系统。
 
-**侧边栏顶部条与完全隐藏。** darwin 上侧边栏展开时有一条 52px 的顶部条，避开红绿灯、承载收起按钮，并作为窗口拖拽区（`-webkit-app-region: drag`；按钮退出拖拽）。收起侧边栏时整列隐藏——`computeColumns` 接受显式 `collapsedWidth`，AppFrame 在 darwin 桌面传 0——而非其他平台保留的 56px rail。重新打开的入口移入会话头部：single、root 作用域的 slot `conversation.header.leading` 位于面包屑之前，ui-sidebar 向其注册 `HeaderLeadingControls`（打开侧边栏 + 新会话，复用 shell 的 inject face 与 locale）。显隐纯由 CSS 依据 AppFrame 发布的 `data-sidebar-collapsed` 属性控制；不新增收起状态管道。darwin 上常驻头部在选中或未选中 Session 时均保持 leading 座挂载，确保侧边栏隐藏时屏幕上始终有重新打开的控件。
+**侧边栏顶部条与完全隐藏。** darwin 上侧边栏展开时有一条 52px 的顶部条，避开红绿灯并承载收起按钮；框架的 `.leadingBand` 拖拽带覆盖同一 52px 几何，顶部条自身不声明 app-region，按钮经 base.css 交互规则自行减除。收起侧边栏时整列隐藏——`computeColumns` 接受显式 `collapsedWidth`，AppFrame 在 darwin 桌面传 0——而非其他平台保留的 56px rail。重新打开的入口位于框架 root 作用域的 `shell.leading` 窗口 chrome 座，由 AppFrame 仅在整列隐藏时挂载；ui-sidebar 向其注册 `HeaderLeadingControls`（打开侧边栏 + 新会话，复用 shell 的 inject face 与 locale）。座的位置、面板用于避让的 `--dsh-frame-leading-clearance` 变量，以及早先会话头部座的移除，归 [shell.leading Agent Note](../architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md) 所有。
 
-**拖拽区。** darwin 上会话标题行是拖拽区，所有可交互后代退出。Electron 按 DOM 顺序以窗口几何计算拖拽区，不看层叠：覆盖标题带的浮层必须自行减除，否则下层区域仍会截获指针。因此右侧边栏的全屏面板对整个盒子设 `-webkit-app-region: no-drag`，再在其 tab 条空白处恢复拖拽。
+**窗口全屏标记。** macOS 全屏隐藏红绿灯，围绕它们构建的布局必须放松。主进程在 `enter-full-screen`、`leave-full-screen` 与每次 `did-finish-load` 时经 `dsh-desktop:window-fullscreen` 转发 `isFullScreen()`；应用 preload 的 `syncWindowFullscreen()` 把它镜像到 `html[data-fullscreen]`。消费者：AppFrame 把 `--dsh-frame-leading-clearance` 降到 84px 并把座移到 `left: 12px`，侧边栏 `.topStrip` 把收起按钮移到条带左端，右侧边栏全屏面板把首格 pane 的 dockkit strip 内边距重置回常规 10px。
+
+**拖拽区。** Electron 按 DOM 顺序以窗口几何计算拖拽区，不看层叠，因此 `-webkit-app-region: drag` 只在两个允许清单样式表内声明：ui-layout `AppFrame.module.css`（darwin 的 `.leadingBand`——52px 全宽、`pointer-events: none`、作为框架第一个子元素渲染的条带——与 Windows 顶栏 `.frame::before`）和 ui-sidebar `SidebarRoot.module.css`（`.logoRow`，把拖拽带向 52px 以下延伸）。所有可交互内容通过 ui-web base.css 的两条全局规则自行减除：一条 `:is(...)` 选择器让每个交互元素（按钮、链接、输入框、role、`[tabindex]`）退出拖拽，一条 `body > :not(#root)` 规则覆盖所有 portal 到 `#root` 之外的浮层。拖拽带先于全部内容挂载，任何靠后的 no-drag 盒子必然生效；内容容器永不声明 drag——那会覆盖更早挂载的浮层。
 
 **全屏避开红绿灯。** ui-dockkit 把 tab 条起始内边距发布为 `--dsh-dockkit-strip-inline-start`（回退为设计自身的 10px）。右侧边栏全屏形态在 darwin 上对面板主体设 88px，并对每个非首格 split 单元的子树重置为 10px，使得任意分屏深度下恰好只有触及窗口左上角的 pane 避开红绿灯。
 
@@ -40,10 +42,10 @@ Electron 主进程在 darwin 上以 `titleBarStyle: 'hiddenInset'`、`trafficLig
 
 - macOS 窗口获得半透明侧边栏与隐藏标题栏，对其他平台零成本：所有规则限定在 `[data-platform='darwin']` 下，该属性仅由 Electron preload 设置。
 - 毛玻璃材质跟随应用主题，含第三方注册主题（取其解析配色）。截图与录屏与纯 Web 的平面渲染不同。
-- `conversation.header.leading` 是客户端 catalog 中的公开 slot；任何包都可占用该座位，ui-sidebar 的占用者假定平台匹配时随时可能渲染。
-- 拖拽区几何是窗口级全局不变量：今后任何在 darwin 上覆盖标题带的浮层必须用 `-webkit-app-region: no-drag` 自行减除，否则其控件不可点击。
+- 重新打开控件占据框架的 `shell.leading` 座，是客户端 catalog 中的公开 slot；早先的 `conversation.session.header.leading` 座已移除（[shell.leading Agent Note](../architecture/2026-09-17-frame-shell-leading-window-chrome-seat.zh.md)）。
+- 拖拽区归属是窗口级全局不变量：`-webkit-app-region: drag` 只出现在两个允许清单样式表内（ui-layout `AppFrame.module.css`：darwin `.leadingBand` 与 Windows 顶栏 `.frame::before`；ui-sidebar `SidebarRoot.module.css`：`.logoRow`）；其他包依赖 base.css 的退出规则或添加限定范围的 `no-drag`，永不新增拖拽面。ui-theme 的 app-region 样式门禁对全部包内样式表强制该允许清单。
 - 接受透明窗口 + 毛玻璃在屏幕共享中呈现不同、启动可能闪烁；透明 `backgroundColor` 缓解闪烁。
 
 ## Testing
 
-ui-theme 引导与 ui-layout presenter 测试钉住 `data-ds-theme-source` 的发布与清除。ui-sidebar apply 测试钉住 leading 座注册（组件、locale、共享 inject face）及 teardown 移除。ui-conversation skeleton 测试钉住 选中或未选中 Session 时对 leading slot 的渲染调用。ui-theme 的 corner-shape 与 full-round 样式门覆盖新样式表。
+ui-theme 引导与 ui-layout presenter 测试钉住 `data-ds-theme-source` 的发布与清除。ui-sidebar apply 测试钉住 `shell.leading` 注册（组件、locale、共享 inject face）及 teardown 移除；ui-layout 的 app-frame 测试钉住 darwin 下座的挂载。desktop main-startup 测试钉住全屏转发（状态切换、重载、已销毁窗口守卫、仅 darwin 注册），preload-platform 测试钉住 `html[data-fullscreen]` 镜像。ui-theme 的 corner-shape 与 full-round 样式门覆盖新样式表，其 app-region 样式门在全部包内样式表上把拖拽区归属钉在两个允许清单样式表内。
diff --git a/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.i18n.yaml
new file mode 100644
index 0000000000..7dd1a29921
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.md
+2026-09-19-remove-desktop-profile-core-cleanup.md: a42100e8dc247611e29ddd2b8075b3b98e388177
+2026-09-19-remove-desktop-profile-core-cleanup.zh.md: 9a6be335a427e3f3083362ffd9e3aaa2f236635d
diff --git a/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.md b/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.md
new file mode 100644
index 0000000000..a42100e8dc
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.md
@@ -0,0 +1,40 @@
+# Agent Note: Remove the Desktop production profile core-package cleanup
+
+Status: implemented
+
+English | [中文](2026-09-19-remove-desktop-profile-core-cleanup.zh.md)
+
+## Problem
+
+Since 2026-09-15, production Desktop cleaned the profile before starting the Host, using the package names listed by the runtime descriptor: it deleted same-named entries under `$DSH_HOME/profiles/desktop/node_modules`, pruned the manifest's dependency declarations and pnpm overrides for those names, discarded the lockfile when package state changed, and removed development-time links once according to `desktop-runtime-state.json`. It targeted two kinds of residue: earlier Desktop builds had installed the core packages into the profile as local tarballs through pnpm, writing declarations, overrides, and a lockfile; and the development mode of the link backend had projected the installation closure into the same profile's `node_modules`. Under nearest-wins resolution those copies shadowed the runtime bundled with the application, combining an old Web frontend with new plugins.
+
+Both kinds of residue exist only on internal development and test machines; Desktop has not been released. Since the runtime ships inside the application, new profiles no longer contain core packages, and after the [link backend removal](../architecture/2026-09-19-profile-resolution-lookup-order.md) development mode writes no links into the profile. The cleanup had to rerun on every production launch and fought the next pnpm operation, which reinstalled packages from the retained declarations.
+
+## Decision
+
+Delete `apps/desktop/src/profile-core-cleanup.ts`, `apps/desktop/src/profile-packages.ts`, and their two specs. `DesktopProjectManager.applyRelease` validates the runtime descriptor, migrates profile settings, creates the profile files, and removes the projections a link-backend launch wrote through the shared `removeLinkProjections`; beyond that, neither production nor development launches modify the profile's `node_modules`, manifest, overrides, lockfile, or `desktop-runtime-state.json`.
+
+Resolution inside the profile follows the [lookup-order Note](../architecture/2026-09-19-profile-resolution-lookup-order.md): packages in the profile's own `node_modules` win as the nearest layer, and installation package names are occupied by the generation at `$DSH_HOME/profiles/node_modules`. When a package installed into the profile declares `@deepseek-ai/*` packages under `dependencies`, pnpm installs copies into the profile and those copies run at their own versions. Official packages keep only pure-function packages under `dependencies` and declare every package with module-level identity as a peer; a third-party plugin that declares an identity-bearing dsh package as a real dependency makes that packaging choice for itself.
+
+Capability given up: core-package copies and their declarations that earlier Desktop builds installed into a profile need one manual removal; `desktop-runtime-state.json` is no longer read or deleted. Projections the link backend wrote are removed by the shared profile load, see the [lookup-order Note](../architecture/2026-09-19-profile-resolution-lookup-order.md).
+
+Reintroduction conditions: a released Desktop wrote core-package copies into external users' profiles, or official packages change their dependency conventions so that profiles gain copies competing with the runtime for identity.
+
+## Alternatives considered
+
+**Keep the original cleanup.** The residue it served is no longer produced, yet it deleted directories, pruned declarations, and discarded the lockfile on every production launch, fighting the following pnpm operations.
+
+**Delete only same-named directories under the profile's `node_modules`, leaving declarations and the lockfile alone.** The 2026-09-15 decision already rejected this: pnpm reinstalls the same old packages from the retained declarations and overrides.
+
+**Give `@deepseek-ai/*` generation entries absolute precedence over same-named copies inside the profile.** That overrides versions plugins bring along and is a new resolution-rule decision outside the scope of removing the cleanup.
+
+**Clean only in the installer.** The 2026-09-15 decision already rejected this: it misses other profiles and cannot reach copies recreated after installation.
+
+## Verification
+
+- [project-manager.spec.ts](../../../../apps/desktop/tests/project-manager.spec.ts) asserts that after one launch preparation the installed core package directory, the third-party plugin directory, the manifest declarations, `desktop-runtime-state.json`, and the lockfile are byte-for-byte unchanged.
+- The repository has no remaining references to `cleanProfileCorePackages`, `migrateDesktopProfileLinks`, `CLEAN_PROFILE_CORE_PACKAGES`, or `DESKTOP_PROFILE_STATE`.
+
+## Consequences
+
+Bought: production launches no longer write into the profile, there is no temporary enable switch, and Desktop and the CLI apply one rule to copies inside a profile. Paid: core-package copies earlier Desktop builds installed into a profile are removed by hand; dsh copies that third-party plugins bring into the profile as real dependencies run at their own versions.
diff --git a/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.zh.md b/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.zh.md
new file mode 100644
index 0000000000..9a6be335a4
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.zh.md
@@ -0,0 +1,40 @@
+# Agent Note: 移除 Desktop 生产启动前的核心包清理
+
+Status: implemented
+
+[English](2026-09-19-remove-desktop-profile-core-cleanup.md) | 中文
+
+## Problem
+
+2026-09-15 起，生产版 Desktop 在启动 Host 前按运行时描述符列出的包名清理 profile：删除 `$DSH_HOME/profiles/desktop/node_modules` 里的同名条目，剪掉 manifest 对这些名字的依赖声明与 pnpm overrides，包状态变化时丢弃锁文件，并按 `desktop-runtime-state.json` 记录一次性移除开发期链接。它针对两类残留：更早的 Desktop 曾把核心包做成本地 tarball 用 pnpm 装进 profile 并写入声明、overrides 与锁文件；Link 后端的开发模式曾把安装闭包投影进同一个 profile 的 `node_modules`。在最近者优先的解析下，这些副本会压过应用自带的运行时，把旧 Web 前端与新插件组合在一起。
+
+这两类残留只存在于内部开发与测试机器上，Desktop 没有对外发布过。运行时随应用打包后，新 profile 不再包含核心包；[Link 后端删除](../architecture/2026-09-19-profile-resolution-lookup-order.zh.md)后，开发模式不再向 profile 写任何链接。清理每次生产启动都要重跑，并与下一次 pnpm 操作按保留的依赖重新安装形成拉锯。
+
+## Decision
+
+删除 `apps/desktop/src/profile-core-cleanup.ts`、`apps/desktop/src/profile-packages.ts` 及其两个 spec。`DesktopProjectManager.applyRelease` 校验运行时描述符、迁移 profile 设置、创建 profile 文件，并通过共享的 `removeLinkProjections` 删除 Link 后端启动写下的投影；除此之外，生产与开发启动都不改动 profile 的 `node_modules`、manifest、overrides、锁文件与 `desktop-runtime-state.json`。
+
+profile 内的解析按[查找顺序 Note](../architecture/2026-09-19-profile-resolution-lookup-order.zh.md)：profile 自己 `node_modules` 里的包最近者优先，本体包名在 `$DSH_HOME/profiles/node_modules` 的位置由 generation 占据。装进 profile 的包若在 `dependencies` 里声明了 `@deepseek-ai/*`，pnpm 会把副本装进 profile，这些副本按其自身版本运行。官方包只把纯函数包放在 `dependencies`，带模块级身份的包一律声明为 peer；第三方插件把身份敏感的 dsh 包写成实依赖，是该插件自身的打包选择。
+
+放弃的能力：旧版 Desktop 装进 profile 的核心包副本及其声明需要手工删除一次；`desktop-runtime-state.json` 不再被读取或删除。Link 后端写下的投影由共享的 profile 加载一次性删除，见[查找顺序 Note](../architecture/2026-09-19-profile-resolution-lookup-order.zh.md)。
+
+重新引入的条件：外部用户的 profile 曾被某个发布版 Desktop 写入核心包副本，或官方包改变依赖声明约定，使 profile 内出现与运行时争抢身份的副本。
+
+## Alternatives considered
+
+**保留原清理。** 它服务的残留不再产生，却在每次生产启动删除目录、剪声明并丢弃锁文件，与随后的 pnpm 操作反复拉锯。
+
+**只删除 profile `node_modules` 里的同名目录，不动声明与锁文件。** 2026-09-15 的决策已经否决：pnpm 会按保留的声明与 overrides 重装相同的旧包。
+
+**让 generation 中的 `@deepseek-ai/*` 条目绝对优先于 profile 内的同名副本。** 这会覆盖插件自带的版本，是解析规则的新决策，不在移除清理的范围内。
+
+**只在安装器中清理。** 2026-09-15 的决策已经否决：遗漏其他 profile，也管不到安装后重新产生的副本。
+
+## Verification
+
+- [project-manager.spec.ts](../../../../apps/desktop/tests/project-manager.spec.ts) 断言一次启动准备后，profile 里已安装的核心包目录、第三方插件目录、manifest 声明、`desktop-runtime-state.json` 与锁文件逐字节不变。
+- 仓库中不再有 `cleanProfileCorePackages`、`migrateDesktopProfileLinks`、`CLEAN_PROFILE_CORE_PACKAGES` 与 `DESKTOP_PROFILE_STATE` 的引用。
+
+## Consequences
+
+买到的：生产启动不再写 profile，没有临时启用开关，Desktop 与 CLI 对 profile 内副本采用同一套规则。付出的：旧版 Desktop 装进 profile 的核心包副本靠手工清理；第三方插件以实依赖带进 profile 的 dsh 副本按其自身版本运行。
diff --git a/apps/cli/reference/README.i18n.yaml b/apps/cli/reference/README.i18n.yaml
index 9e7046f98e..0cff0e5cdb 100644
--- a/apps/cli/reference/README.i18n.yaml
+++ b/apps/cli/reference/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/reference/README.md
-README.md: a1fde26aa5a043680f8a3bfc9c8057c690cf1eeb
-README.zh.md: d98acec29f80688ef323830d0c7978069b2d7f63
+README.md: cf0e1400f2dc8cd29cc59cefbdda379df2e0b899
+README.zh.md: a01818f59ccf54f3f826c68505bfb830a9316664
diff --git a/apps/cli/reference/README.md b/apps/cli/reference/README.md
index a1fde26aa5..cf0e1400f2 100644
--- a/apps/cli/reference/README.md
+++ b/apps/cli/reference/README.md
@@ -8,7 +8,7 @@ This reference defines the profile, plugin-management, and config-dump command m
 
 `dsh <name>` abbreviates `dsh --profile <name>` and boots the profile at `$DSH_HOME/profiles/<name>`. The shorthand name must immediately follow `dsh`; `plugin` remains the plugin-management command, so boot a profile with that name using `dsh --profile plugin`. The effective tree is composed over an empty root by applying, in order: each bundle patch named in the profile manifest's `dsh.profile.bundles` list, the profile's own `cordis.patch.yml`, the home-level `$DSH_HOME/cordis.patch.yml` (machine-local preferences shared by every profile, so it outranks the per-profile layer), and each `--patch <path>` overlay in argv order. Later layers win per row; a patch replaces the targeted row's complete `config` value rather than deep-merging keys, and may insert new rows. The final YAML composition controls whether `dsh-hmr` watches configuration; without HMR, changes require restart. A parse, schema, resolution, or plugin boot failure is reported and exits nonzero. SIGINT and SIGTERM dispose the mounted root before exit.
 
-Bundle names resolve from the dsh installation first, then from the profile directory. In-box bundles (`@deepseek-ai/dsh-base`, `@deepseek-ai/dsh-web-app`, `@deepseek-ai/dsh-headless`, `@deepseek-ai/dsh-sdk-app`, `@deepseek-ai/dsh-sdk-minimal`, `@deepseek-ai/dsh-acp-app`) therefore always come from the same installation as the running `dsh`; out-of-tree bundles come from the profile's pnpm-managed `node_modules`. Before mounting rows, the launcher traverses the installation and selected bundles in that order and installs the resulting immutable generation into Node's runtime resolvers. Startup creates no shared or profile-owned fallback links. Profile-installed packages keep native priority; profile initialization and package-manager writes remain separate from runtime resolution.
+Bundle names resolve from the dsh installation first, then from the profile directory. In-box bundles (`@deepseek-ai/dsh-base`, `@deepseek-ai/dsh-web-app`, `@deepseek-ai/dsh-headless`, `@deepseek-ai/dsh-sdk-app`, `@deepseek-ai/dsh-sdk-minimal`, `@deepseek-ai/dsh-acp-app`) therefore always come from the same installation as the running `dsh`; out-of-tree bundles come from the profile's pnpm-managed `node_modules`. Before mounting rows, the launcher traverses the installation and selected bundles in that order and installs the resulting immutable runtime resolution into Node's resolvers. Startup creates no shared or profile-owned fallback links. Profile-installed packages keep native priority; profile initialization and package-manager writes remain separate from runtime resolution.
 
 The `web`, `headless`, `sdk`, `sdk-minimal`, and `acp` profiles auto-initialize from shipped templates on first use (`web`: base + web-app with live patches; `headless`: base + headless with startup-only patches; `sdk`: base + sdk-app with startup-only patches; `sdk-minimal`: its standalone bundle with startup-only patches; `acp`: base + acp-app with startup-only patches). Any other missing profile fails loudly with a hint to run `dsh plugin --profile <name> add <package>`.
 
@@ -48,7 +48,7 @@ dsh --profile web --dump-default-config
 dsh --profile web --patch ./extra.yml --dump-config
 ```
 
-`--dump-default-config` prints only the bundle layers; `--dump-config` adds the profile's `cordis.patch.yml`, the home-level `$DSH_HOME/cordis.patch.yml`, and `--patch` overlays. Both print comments naming the file that supplied each row and every overlay that changed it; `!!js` expressions remain unevaluated, relative plugin names in inserted rows resolve beside their patch file, and unmatched patch targets are reported on stderr. A dump initializes missing profile files but does not prepare the runtime module fallback under `$DSH_HOME/profiles/node_modules`. It never runs app command-line providers, so it shows the composed tree before any app argument is resolved and rejects an invocation that carries app arguments.
+`--dump-default-config` prints only the bundle layers; `--dump-config` adds the profile's `cordis.patch.yml`, the home-level `$DSH_HOME/cordis.patch.yml`, and `--patch` overlays. Both print comments naming the file that supplied each row and every overlay that changed it; `!!js` expressions remain unevaluated, relative plugin names in inserted rows resolve beside their patch file, and unmatched patch targets are reported on stderr. A dump initializes missing profile files. It never runs app command-line providers, so it shows the composed tree before any app argument is resolved and rejects an invocation that carries app arguments.
 
 <a id="startup-diagnostics"></a>
 ## Startup diagnostics
diff --git a/apps/cli/reference/README.zh.md b/apps/cli/reference/README.zh.md
index d98acec29f..a01818f59c 100644
--- a/apps/cli/reference/README.zh.md
+++ b/apps/cli/reference/README.zh.md
@@ -10,7 +10,7 @@
 
 `dsh <name>` 是 `dsh --profile <name>` 的简写，启动位于 `$DSH_HOME/profiles/<name>` 的 profile。简写中的名称必须紧跟 `dsh`；`plugin` 仍为插件管理命令，因此启动同名 profile 时须使用 `dsh --profile plugin`。生效配置树以空根节点为起点，依次叠加 profile manifest（元数据清单）的 `dsh.profile.bundles` 列表中指定的各组合包 patch、profile 自身的 `cordis.patch.yml`、home 级的 `$DSH_HOME/cordis.patch.yml`（这是各 profile 共享的机器本地偏好，因此优先于逐 profile 配置层），以及按 argv 顺序指定的各个 `--patch <path>` 覆盖层。对同一配置行，后应用的层优先。patch 会替换目标行的整个 `config` 值，而不是深度合并其中的键；patch 也可以插入新行。最终 YAML 组合决定是否由 `dsh-hmr` 监视配置；未启用 HMR 时，更改需要重启。配置解析、schema 校验、模块解析或插件启动失败时，系统会报告错误并以非零状态退出。收到 SIGINT 或 SIGTERM 时，挂载的根节点会先 dispose（资源释放）再退出。
 
-组合包名称先从 dsh 安装目录解析，再从 profile 目录解析。因此，内置组合包（`@deepseek-ai/dsh-base`、`@deepseek-ai/dsh-web-app`、`@deepseek-ai/dsh-headless`、`@deepseek-ai/dsh-sdk-app`、`@deepseek-ai/dsh-sdk-minimal`、`@deepseek-ai/dsh-acp-app`）始终来自当前运行的 `dsh` 所属的安装；树外组合包来自 profile 中由 pnpm 管理的 `node_modules`。挂载配置行前，launcher 会按此顺序遍历安装与所选 bundle，并将生成的不可变 generation 安装到 Node 的运行时解析器中。启动不会创建共享或 profile 自有的 fallback 链接。profile 已安装包保留原生优先级；profile 初始化和包管理器写入与运行时解析相互独立。
+组合包名称先从 dsh 安装目录解析，再从 profile 目录解析。因此，内置组合包（`@deepseek-ai/dsh-base`、`@deepseek-ai/dsh-web-app`、`@deepseek-ai/dsh-headless`、`@deepseek-ai/dsh-sdk-app`、`@deepseek-ai/dsh-sdk-minimal`、`@deepseek-ai/dsh-acp-app`）始终来自当前运行的 `dsh` 所属的安装；树外组合包来自 profile 中由 pnpm 管理的 `node_modules`。挂载配置行前，launcher 会按此顺序遍历安装与所选 bundle，并将生成的不可变 runtime resolution 安装到 Node 的解析器中。启动不会创建共享或 profile 自有的 fallback 链接。profile 已安装包保留原生优先级；profile 初始化和包管理器写入与运行时解析相互独立。
 
 `web`、`headless`、`sdk`、`sdk-minimal` 和 `acp` profile 首次使用时会从随附模板自动初始化（`web`：base + web-app，实时应用 patch；`headless`：base + headless，只在启动时应用 patch；`sdk`：base + sdk-app，只在启动时应用 patch；`sdk-minimal`：独立组合包，只在启动时应用 patch；`acp`：base + acp-app，只在启动时应用 patch）。其他缺失的 profile 会显式报错，并提示运行 `dsh plugin --profile <name> add <package>`。
 
@@ -50,7 +50,7 @@ dsh --profile web --dump-default-config
 dsh --profile web --patch ./extra.yml --dump-config
 ```
 
-`--dump-default-config` 只打印组合包各层；`--dump-config` 额外加上 profile 的 `cordis.patch.yml`、home 级的 `$DSH_HOME/cordis.patch.yml` 和 `--patch` overlay。两者都会打印注释，标明每行由哪个文件提供，以及哪些 overlay 修改过它；`!!js` 表达式保持未求值，插入行中的相对插件名以各自 patch 文件所在目录解析，找不到目标的 patch 会报告到 stderr。dump 操作会初始化缺失的 profile 文件，但不会准备 `$DSH_HOME/profiles/node_modules` 下的运行时模块 fallback。它不会运行应用的命令行参数提供方，因此展示的是解析任何应用参数之前的组合配置树；如果调用中包含应用参数，dump 会拒绝该调用。
+`--dump-default-config` 只打印组合包各层；`--dump-config` 额外加上 profile 的 `cordis.patch.yml`、home 级的 `$DSH_HOME/cordis.patch.yml` 和 `--patch` overlay。两者都会打印注释，标明每行由哪个文件提供，以及哪些 overlay 修改过它；`!!js` 表达式保持未求值，插入行中的相对插件名以各自 patch 文件所在目录解析，找不到目标的 patch 会报告到 stderr。dump 操作会初始化缺失的 profile 文件。它不会运行应用的命令行参数提供方，因此展示的是解析任何应用参数之前的组合配置树；如果调用中包含应用参数，dump 会拒绝该调用。
 
 <a id="startup-diagnostics"></a>
 ## 启动诊断
diff --git a/apps/cli/src/profile-boot.ts b/apps/cli/src/profile-boot.ts
index ededd48a87..9e40d01f70 100644
--- a/apps/cli/src/profile-boot.ts
+++ b/apps/cli/src/profile-boot.ts
@@ -18,9 +18,7 @@ import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
 import {
   boot,
   readProfilePatches,
-  createProfileResolutionGeneration,
-  healProfilesModuleFallback,
-  healIsolatedProfileModuleFallback,
+  createRuntimeResolution,
   initProfile,
   installFailLoud,
   loadOverlayPatches,
@@ -31,8 +29,7 @@ import {
   resolveProfileDir,
   type ProfileContext,
   type Profile,
-  type ProfileResolutionGeneration,
-  type ProfileResolutionMode,
+  type RuntimeResolution,
 } from '@deepseek-ai/dsh-app-boot'
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
 import { installProxyFromEnvironment } from '@deepseek-ai/dsh-http-proxy'
@@ -176,8 +173,8 @@ export function prepareProfile(name: string, userLayer = true, fromDefaultProfil
 /** One profile's patch layers, in application order. */
 interface ComposedProfile {
   profile: Profile
-  /** Immutable package fallback selected before any plugin imports. */
-  resolution: ProfileResolutionGeneration
+  /** Immutable runtime resolution computed before any plugin imports. */
+  resolution: RuntimeResolution
   /** Command-line overlay contents, frozen for this invocation. */
   overlays: PatchOptions[]
 }
@@ -191,7 +188,6 @@ interface ComposedProfile {
  * then the telemetry switch.
  * @param name - the profile name.
  * @param patchFiles - `--patch` overlay paths, in argv order.
- * @param resolutionMode - runtime lookup, disk links, or dual verification of both.
  * @param fromDefaultProfile - shipped template for a missing named profile.
  * @param resolvedProfile - application-owned profile and installation.
  * @returns the profile and its patch layers.
@@ -199,17 +195,13 @@ interface ComposedProfile {
 async function composeProfile(
   name: string,
   patchFiles: readonly string[],
-  resolutionMode: ProfileResolutionMode,
   fromDefaultProfile?: string,
   resolvedProfile?: ResolvedProfileRuntime,
 ): Promise<ComposedProfile> {
   const profile = resolvedProfile?.profile ?? prepareProfile(name, true, fromDefaultProfile)
   if (resolvedProfile !== undefined) writeFileSync(join(profile.dir, PROFILE_ROOT_FILENAME), PROFILE_ROOT_CONFIG)
   const resolutionOptions = { installAnchor: resolvedProfile?.installAnchor ?? INSTALL_ANCHOR, profile }
-  if (resolvedProfile !== undefined && resolutionMode !== 'runtime') healIsolatedProfileModuleFallback(resolvedProfile)
-  const resolution = resolutionMode === 'runtime' || resolvedProfile !== undefined
-    ? await createProfileResolutionGeneration(resolutionOptions)
-    : await healProfilesModuleFallback(resolutionOptions)
+  const resolution = await createRuntimeResolution(resolutionOptions)
   const overlays = patchFiles.flatMap(file => loadOverlayPatches(NAME, resolve(file)))
   return { profile, resolution, overlays }
 }
@@ -238,8 +230,6 @@ export interface RunProfileOptions {
   args: readonly string[]
   /** Application-owned package runtime, scoped to plugin package operations. */
   packageManager?: ProfileContext['packageManager']
-  /** Module fallback backend; defaults to runtime. Plain Node callers may override it; pkg executables always use runtime. */
-  resolutionMode?: ProfileResolutionMode
 }
 
 /**
@@ -259,8 +249,6 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con
     (message) => { process.stderr.write(`${NAME}: ${message}\n`) },
   )
 
-  const packaged = (process as NodeJS.Process & { pkg?: unknown }).pkg !== undefined
-  const resolutionMode = packaged ? 'runtime' : options.resolutionMode ?? 'runtime'
   const app: { current?: Context } = {}
   let disposal: Promise<void> | undefined
   const dispose = (): Promise<void> => disposal ??= (async () => {
@@ -273,7 +261,7 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con
   })()
   try {
     const composed = await composeProfile(
-      options.profile, options.patchFiles, resolutionMode, options.fromDefaultProfile, options.resolvedProfile,
+      options.profile, options.patchFiles, options.fromDefaultProfile, options.resolvedProfile,
     )
     const appReady = createAppReady()
     const shutdown = createProcessShutdown(dispose)
@@ -309,9 +297,8 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con
       // Before any config-tree entry mounts, so plugins resolve all launch-time
       // environment values from the same immutable launch snapshot.
       hostCtx.provide(DSH_LAUNCH_ENVIRONMENT_KEY, options.environment)
-      await hostCtx.plugin(PluginPackages, resolutionMode === 'link' ? {} : {
-        generation: composed.resolution,
-        behavior: resolutionMode === 'dual' ? 'verify' : 'enforce',
+      await hostCtx.plugin(PluginPackages, {
+        resolution: composed.resolution,
       })
       // The command line and bounded exit request are launcher facts available
       // to every app plugin that injects the argument snapshot.
diff --git a/apps/cli/tests/built-bin.e2e.ts b/apps/cli/tests/built-bin.e2e.ts
index dbaf904569..1cd1c1636c 100644
--- a/apps/cli/tests/built-bin.e2e.ts
+++ b/apps/cli/tests/built-bin.e2e.ts
@@ -17,6 +17,7 @@ import { entryListSchema } from '@deepseek-ai/cordis-plugin-include'
 import { execa } from 'execa'
 import * as yaml from 'js-yaml'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { testProfileResolution } from './profiles/headless/tests/profile-resolution.ts'
 
 /** Published-entry acceptance for argument errors, profile lifecycle, and boot-free config dumps. */
 const repoRoot = fileURLToPath(new URL('../../../', import.meta.url))
@@ -341,6 +342,8 @@ function startStartupProfile(fixture: StartupFixture, args: readonly string[]) {
 }
 
 describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)', () => {
+  testProfileResolution('lib')
+
   it('requires a profile and rejects removed flags', async () => {
     const bare = await runBuiltBin()
     expect(bare.code).toBe(1)
diff --git a/apps/cli/tests/desktop-host.e2e.ts b/apps/cli/tests/desktop-host.e2e.ts
index a7326e5860..dce2ecbce0 100644
--- a/apps/cli/tests/desktop-host.e2e.ts
+++ b/apps/cli/tests/desktop-host.e2e.ts
@@ -47,7 +47,7 @@ it.each([false, true])('settles startup after parent IPC disconnect (boot failur
   copyFileSync(join(hostDirectory, 'lib', 'index.js'), entry)
   const pnpm = join(root, 'bundled-pnpm.mjs')
   const nodeBin = join(root, 'bin')
-  const child = fork(entry, [root, root, root, 'runtime', pnpm, nodeBin], { execArgv: [], stdio: ['ignore', 'ignore', 'pipe', 'ipc'] })
+  const child = fork(entry, [root, root, root, pnpm, nodeBin], { execArgv: [], stdio: ['ignore', 'ignore', 'pipe', 'ipc'] })
   let stderr = ''
   child.stderr!.setEncoding('utf8').on('data', (chunk: string) => { stderr += chunk })
   const exited = new Promise<number | null>(resolve => child.once('exit', resolve))
diff --git a/apps/cli/tests/fixtures/source-tool-driver.ts b/apps/cli/tests/fixtures/source-tool-driver.ts
new file mode 100644
index 0000000000..c448f4320d
--- /dev/null
+++ b/apps/cli/tests/fixtures/source-tool-driver.ts
@@ -0,0 +1,71 @@
+/** Source-profile tool-dispatch evidence from the real Agent and Node module cache. */
+
+import { randomUUID } from 'node:crypto'
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/cordis-plugin-loader'
+import type {} from '@deepseek-ai/dsh-agent'
+import type {} from '@deepseek-ai/dsh-cmdline'
+import { createUserMessage } from '@deepseek-ai/dsh-llm'
+import { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session'
+
+/** Observations from one isolated Agent's run through the shipped headless profile. */
+export interface SourceToolEvidence {
+  execArgv: string[]
+  modules: string[]
+  errors: string[]
+  events: SessionEvent<'tool/call' | 'tool/result' | 'turn/end'>[]
+}
+
+/** Services needed to drive the Agent and inspect loaded modules. */
+export const inject = ['agents', 'loader']
+
+/**
+ * Drive one mock-model turn after application readiness and dispose it before requesting exit.
+ * @param ctx - context in the source-launched headless Loader tree.
+ * @param config - isolated working directory for the Agent.
+ */
+export function apply(ctx: Context, config: { cwd: string }): void {
+  const ready = ctx.get('appReady')
+  const exit = ctx.get('appExit')
+  if (ready === undefined || exit === undefined) throw new Error('Source tool driver requires appReady and appExit')
+  const events: SourceToolEvidence['events'] = []
+  const errors: string[] = []
+  ctx.on('session/event', (_session, event) => {
+    if (event.type === 'tool/call' || event.type === 'tool/result' || event.type === 'turn/end') events.push(event)
+  }, { global: true })
+  ctx.on('agent/error', ({ error }) => { errors.push(error instanceof Error ? error.message : String(error)) }, { global: true })
+
+  const run = async (): Promise<void> => {
+    const handle = await ctx.agents.create({
+      sessionId: SessionId(randomUUID()),
+      meta: { cwd: config.cwd },
+      agentOptions: { provider: 'cli-mock', model: 'cli-mock' },
+    })
+    try {
+      handle.agent.followup(createUserMessage({
+        source: { kind: 'user' },
+        content: [{ type: 'text', text: 'Run the shell smoke command once.' }],
+      }))
+      await handle.agent.whenIdle()
+      const internal = ctx.loader.internal
+      if (internal === undefined) throw new Error('Source tool driver requires Node module-cache introspection')
+      const evidence: SourceToolEvidence = {
+        execArgv: process.execArgv,
+        modules: [...internal.loadCache.keys()].filter(url => /\/packages\/core\/(?:tools|agent-loop)\//.test(url)),
+        errors,
+        events,
+      }
+      process.stdout.write(`DSH_SOURCE_TOOL_RESULT ${JSON.stringify(evidence)}\n`)
+    } finally {
+      await handle.dispose()
+    }
+    exit(errors.length === 0 ? 0 : 1)
+  }
+
+  ctx.effect(() => ready.onReady(() => {
+    void run().catch((error: unknown) => {
+      process.stderr.write(`${error instanceof Error ? error.stack : String(error)}\n`)
+      exit(1)
+    })
+  }), 'source tool driver')
+}
diff --git a/apps/cli/tests/profiles/headless/tests/profile-resolution.ts b/apps/cli/tests/profiles/headless/tests/profile-resolution.ts
new file mode 100644
index 0000000000..80601c27c6
--- /dev/null
+++ b/apps/cli/tests/profiles/headless/tests/profile-resolution.ts
@@ -0,0 +1,254 @@
+/** Real CLI profile imports in source and built launches, including npm-link dependency layouts. */
+
+import { realpathSync } from 'node:fs'
+import { mkdir, mkdtemp, readFile, readdir, readlink, rm, symlink, unlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { resolveExampleLaunch, type ExampleMode } from '@deepseek-ai/dsh-loader-smoke'
+import { execa } from 'execa'
+import { expect, it } from 'vitest'
+
+const repoRoot = fileURLToPath(new URL('../../../../../../', import.meta.url))
+const processTimeoutMs = 75_000
+const bundleName = 'profile-resolution-bundle'
+const bridgeName = 'profile-resolution-bridge'
+const leafName = 'profile-resolution-leaf'
+const pluginName = 'profile-resolution-plugin'
+const externalName = 'profile-resolution-external'
+const externalLeafName = 'profile-resolution-external-leaf'
+const marker = 'DSH_PROFILE_RESOLUTION '
+
+interface ResolutionEvidence {
+  execArgv: string[]
+  esm: { version: string; url: string }
+  cjs: { version: string; filename: string }
+  sameEsmLeaf: boolean
+  sameCjsLeaf: boolean
+  externalEsm: { version: string; url: string; leaf: ResolutionEvidence['esm'] }
+  externalCjs: { version: string; filename: string; leaf: ResolutionEvidence['cjs'] }
+  sameEsmExternal: boolean
+  sameCjsExternal: boolean
+  sameEsmExternalLeaf: boolean
+  sameCjsExternalLeaf: boolean
+  externalManaged: boolean
+  toolsInstance: boolean
+  scheduler: boolean
+  modules: string[]
+}
+
+async function writePackage(dir: string, manifest: Record<string, unknown>, files: Record<string, string>): Promise<void> {
+  await mkdir(dir, { recursive: true })
+  await writeFile(join(dir, 'package.json'), JSON.stringify(manifest) + '\n')
+  for (const [name, content] of Object.entries(files)) await writeFile(join(dir, name), content + '\n')
+}
+
+/**
+ * Register the same runtime-resolution assertions in the source-only and built-bin lanes.
+ * @param mode - source uses the CLI's ESM-only tsx hook; lib requires built workspace exports.
+ */
+export function testProfileResolution(mode: ExampleMode): void {
+  it.each(['installed', 'npm-link'] as const)(`resolves a %s profile dependency graph in ${mode} mode`, {
+    timeout: processTimeoutMs + 15_000, retry: 0,
+  }, async (layout) => {
+    // The child reports loaded module paths in the form DSH_HOME was given; hand it the native realpath so
+    // Windows 8.3 tmpdir names and macOS /var symlinks match the expectations computed below.
+    const root = realpathSync.native(await mkdtemp(join(tmpdir(), 'dsh-profile-resolution-')))
+    const links: string[] = []
+    try {
+      const home = join(root, 'home')
+      const profileDir = join(home, 'profiles', 'headless')
+      const installedBundle = join(profileDir, 'node_modules', bundleName)
+      const bundleDir = layout === 'npm-link' ? join(root, 'work', bundleName) : installedBundle
+      const installedBridge = join(bundleDir, 'node_modules', bridgeName)
+      const bridgeDir = layout === 'npm-link' ? join(root, 'dependencies', bridgeName) : installedBridge
+      const logicalLeaf = join(bundleDir, 'node_modules', leafName)
+      const realLeaf = join(root, 'dependencies', 'node_modules', leafName)
+      const exports = { import: './index.mjs', require: './index.cjs' }
+      await writePackage(bundleDir, {
+        name: bundleName, version: '1.0.0', dependencies: { [bridgeName]: '*' },
+        dsh: { bundle: { patch: './cordis.patch.yml' } },
+      }, { 'cordis.patch.yml': '[]' })
+      await writePackage(bridgeDir, {
+        name: bridgeName, version: '1.0.0', exports, dependencies: { [leafName]: '*' },
+      }, {
+        'index.mjs': `export { leaf } from '${leafName}'`,
+        'index.cjs': `module.exports = require('${leafName}')`,
+      })
+      for (const [dir, version] of [[logicalLeaf, '1.0.0'], [realLeaf, '2.0.0']] as const) {
+        await writePackage(dir, { name: leafName, version, exports }, {
+          'index.mjs': `export const leaf = { version: '${version}', url: import.meta.url }`,
+          'index.cjs': `exports.leaf = { version: '${version}', filename: __filename }`,
+        })
+      }
+      if (layout === 'npm-link') {
+        const globalBundle = join(root, 'npm-global', 'node_modules', bundleName)
+        for (const [target, link] of [[bundleDir, globalBundle], [globalBundle, installedBundle], [bridgeDir, installedBridge]] as const) {
+          await mkdir(dirname(link), { recursive: true })
+          await symlink(target, link, 'junction')
+          links.push(link)
+        }
+      }
+
+      const sharedModules = join(home, 'profiles', 'node_modules')
+      const pluginDir = join(profileDir, 'node_modules', pluginName)
+      const sharedExternal = join(sharedModules, externalName)
+      const externalDir = layout === 'npm-link' ? join(root, 'external', externalName) : sharedExternal
+      const externalLeaf = join(externalDir, 'node_modules', externalLeafName)
+      const sharedLeaf = join(sharedModules, externalLeafName)
+      const ancestorExternal = join(home, 'node_modules', externalName)
+      const ancestorLeaf = join(home, 'node_modules', externalLeafName)
+      await writePackage(pluginDir, {
+        name: pluginName, version: '1.0.0', exports, dependencies: { [externalName]: '*' },
+      }, {
+        'index.mjs': `export { external } from '${externalName}'\nexport function apply() {}`,
+        'index.cjs': `module.exports = require('${externalName}')`,
+      })
+      for (const [dir, version] of [[externalDir, '3.0.0'], [ancestorExternal, '9.0.0']] as const) {
+        await writePackage(dir, { name: externalName, version, exports, dependencies: { [externalLeafName]: '*' } }, {
+          'index.mjs': `import { leaf } from '${externalLeafName}'\nexport const external = { version: '${version}', url: import.meta.url, leaf }`,
+          'index.cjs': `exports.external = { version: '${version}', filename: __filename, leaf: require('${externalLeafName}').leaf }`,
+        })
+      }
+      for (const [dir, version] of [[externalLeaf, '4.0.0'], [sharedLeaf, '8.0.0'], [ancestorLeaf, '9.0.0']] as const) {
+        await writePackage(dir, { name: externalLeafName, version, exports }, {
+          'index.mjs': `export const leaf = { version: '${version}', url: import.meta.url }`,
+          'index.cjs': `exports.leaf = { version: '${version}', filename: __filename }`,
+        })
+      }
+      const staleTools = join(root, 'stale-tools')
+      const staleToolsLink = join(sharedModules, '@deepseek-ai', 'dsh-tools')
+      await writePackage(staleTools, { name: '@deepseek-ai/dsh-tools', version: '0.0.0', exports }, {
+        'index.mjs': "export default class Tools {}\nexport const TOOL_RUNTIME_SCHEDULER = Symbol()\nthrow new Error('STALE_DSH_TOOLS')",
+        'index.cjs': "throw new Error('STALE_DSH_TOOLS')",
+      })
+      for (const [target, link] of [
+        [staleTools, staleToolsLink],
+        ...layout === 'npm-link' ? [[externalDir, sharedExternal]] as const : [],
+      ] as const) {
+        await mkdir(dirname(link), { recursive: true })
+        await symlink(target, link, 'junction')
+        links.push(link)
+      }
+
+      // The probe imports from the profile, where the bundle's transitive dependencies need fallback.
+      await writePackage(profileDir, {
+        name: 'resolution-profile', private: true, dependencies: { [bundleName]: '*', [pluginName]: '*' },
+        dsh: { profile: { bundles: ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-headless', bundleName] } },
+      }, {
+        'probe.mjs': [
+          "import { createRequire } from 'node:module'",
+          "import { getEnvironmentData } from 'node:worker_threads'",
+          "import Tools, { TOOL_RUNTIME_SCHEDULER } from '@deepseek-ai/dsh-tools'",
+          `import { leaf } from '${leafName}'`,
+          `import { leaf as bridgeLeaf } from '${bridgeName}'`,
+          `import { external } from '${externalName}'`,
+          `import { external as pluginExternal } from '${pluginName}'`,
+          `import { leaf as externalLeaf } from ${JSON.stringify(pathToFileURL(join(externalLeaf, 'index.mjs')).href)}`,
+          'const require = createRequire(import.meta.url)',
+          "export const inject = ['tools', 'agentLoop', 'loader']",
+          'export function apply(ctx) {',
+          "  const ready = ctx.get('appReady')",
+          "  const exit = ctx.get('appExit')",
+          '  ctx.effect(() => ready.onReady(() => {',
+          `    const cjs = require('${leafName}').leaf`,
+          `    const externalCjs = require('${externalName}').external`,
+          "    const entries = getEnvironmentData('@deepseek-ai/dsh-app-boot/profile-resolution').resolution.entries",
+          '    const evidence = {',
+          '      execArgv: process.execArgv, esm: leaf, cjs,',
+          '      sameEsmLeaf: leaf === bridgeLeaf,',
+          `      sameCjsLeaf: cjs === require('${bridgeName}').leaf,`,
+          '      externalEsm: external, externalCjs,',
+          '      sameEsmExternal: external === pluginExternal,',
+          `      sameCjsExternal: externalCjs === require('${pluginName}').external,`,
+          '      sameEsmExternalLeaf: external.leaf === externalLeaf,',
+          `      sameCjsExternalLeaf: externalCjs.leaf === require(${JSON.stringify(join(externalLeaf, 'index.cjs'))}).leaf,`,
+          `      externalManaged: entries.some(entry => [${JSON.stringify(externalName)}, ${JSON.stringify(externalLeafName)}].includes(entry.name)),`,
+          '      toolsInstance: ctx.tools instanceof Tools,',
+          "      scheduler: typeof ctx.tools[TOOL_RUNTIME_SCHEDULER]?.prepare === 'function',",
+          '      modules: [...ctx.loader.internal.loadCache.keys()]',
+          '        .filter(url => /\\/packages\\/core\\/(?:tools|agent-loop)\\//.test(url)),',
+          '    }',
+          `    process.stdout.write('${marker}' + JSON.stringify(evidence) + '\\n')`,
+          '    exit(0)',
+          "  }), 'profile resolution probe')",
+          '}',
+        ].join('\n'),
+        'cordis.patch.yml': JSON.stringify([
+          { id: 'headless-startup', disabled: true },
+          { id: 'headless-runner', disabled: true },
+          { id: 'llm-deepseek', disabled: true },
+          { insert: [
+            { id: 'external-plugin', name: pluginName },
+            { id: 'resolution-probe', name: join(profileDir, 'probe.mjs') },
+          ] },
+        ]),
+      })
+      const packageDirs = [
+        bundleDir, bridgeDir, logicalLeaf, realLeaf, pluginDir, externalDir, externalLeaf,
+        sharedLeaf, ancestorExternal, ancestorLeaf, staleTools, profileDir,
+      ]
+      const packageFiles = (await Promise.all(packageDirs.map(async dir =>
+        (await readdir(dir, { withFileTypes: true })).filter(entry => entry.isFile()).map(entry => join(dir, entry.name)),
+      ))).flat()
+      const contents = await Promise.all(packageFiles.map(async path => [path, await readFile(path)] as const))
+      const linkTargets = await Promise.all(links.map(async path => [path, await readlink(path)] as const))
+      const launch = resolveExampleLaunch({
+        srcBin: join(repoRoot, 'apps/cli/src/bin.ts'),
+        mode, sourceImport: 'tsx/esm', tsconfigPath: join(repoRoot, 'tsconfig.json'),
+        configArgs: ['--profile', 'headless'],
+        env: {
+          DSH_HOME: home, DSH_AGENTS_HOME: join(root, 'agents'), DSH_TELEMETRY_DISABLED: '1',
+          NODE_OPTIONS: undefined, TSX_TSCONFIG_PATH: undefined,
+        },
+      })
+      const result = await execa(launch.command, launch.args, {
+        cwd: repoRoot, env: launch.env, input: '', timeout: processTimeoutMs,
+        killSignal: 'SIGKILL', reject: false,
+      })
+      const diagnostic = `stdout:\n${result.stdout}\nstderr:\n${result.stderr}`
+      expect(result.timedOut, diagnostic).toBe(false)
+      expect(result.signal, diagnostic).toBeUndefined()
+      expect(result.exitCode, diagnostic).toBe(0)
+      const records = result.stdout.split('\n').filter(line => line.startsWith(marker))
+      expect(records, diagnostic).toHaveLength(1)
+      const evidence = JSON.parse(records[0]!.slice(marker.length)) as ResolutionEvidence
+      const selectedLeaf = layout === 'npm-link' ? realLeaf : logicalLeaf
+      const version = layout === 'npm-link' ? '2.0.0' : '1.0.0'
+      expect(evidence.esm).toEqual({ version, url: pathToFileURL(realpathSync.native(join(selectedLeaf, 'index.mjs'))).href })
+      expect(evidence.cjs).toEqual({ version, filename: realpathSync.native(join(selectedLeaf, 'index.cjs')) })
+      expect(evidence.sameEsmLeaf).toBe(true)
+      expect(evidence.sameCjsLeaf).toBe(true)
+      expect(evidence.externalEsm).toEqual({
+        version: '3.0.0', url: pathToFileURL(realpathSync.native(join(externalDir, 'index.mjs'))).href,
+        leaf: { version: '4.0.0', url: pathToFileURL(realpathSync.native(join(externalLeaf, 'index.mjs'))).href },
+      })
+      expect(evidence.externalCjs).toEqual({
+        version: '3.0.0', filename: realpathSync.native(join(externalDir, 'index.cjs')),
+        leaf: { version: '4.0.0', filename: realpathSync.native(join(externalLeaf, 'index.cjs')) },
+      })
+      expect(evidence.sameEsmExternal).toBe(true)
+      expect(evidence.sameCjsExternal).toBe(true)
+      expect(evidence.sameEsmExternalLeaf).toBe(true)
+      expect(evidence.sameCjsExternalLeaf).toBe(true)
+      expect(evidence.externalManaged).toBe(false)
+      expect(evidence.toolsInstance).toBe(true)
+      expect(evidence.scheduler).toBe(true)
+      expect(evidence.execArgv).toEqual(mode === 'src' ? launch.args.slice(0, 2) : [])
+      for (const name of ['tools', 'agent-loop']) {
+        const selected = mode === 'src' ? 'src/index.ts' : 'lib/index.js'
+        const other = mode === 'src' ? 'lib' : 'src'
+        expect(evidence.modules.filter(url => url.endsWith(`/packages/core/${name}/${selected}`))).toHaveLength(1)
+        expect(evidence.modules.filter(url => url.includes(`/packages/core/${name}/${other}/`))).toEqual([])
+      }
+      for (const [path, content] of contents) expect(await readFile(path), path).toEqual(content)
+      for (const [path, target] of linkTargets) expect(await readlink(path), path).toBe(target)
+    } finally {
+      try {
+        for (const link of links.reverse()) await unlink(link)
+      } finally {
+        await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+      }
+    }
+  })
+}
diff --git a/apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts b/apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts
new file mode 100644
index 0000000000..0436a1032b
--- /dev/null
+++ b/apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts
@@ -0,0 +1,106 @@
+/**
+ * Source CLI tool execution with the native addon and generated typert contributors
+ * prepared by the build-backed smoke lane; core workspace modules must stay in src.
+ *
+ * The assertion accepts a real tool result or an explicit SandboxUnavailableError: the
+ * subject is that a source-profile tool call reaches tool/result through one Tools instance,
+ * not that the host can confine the shell. keyless-smoke.e2e.ts in the same gate owns the
+ * confinement round trip and stays strict; on CI prepare-ci-bubblewrap.sh makes both paths
+ * succeed, so the error branch only runs on hosts whose sandbox probe fails.
+ */
+
+import { existsSync } from 'node:fs'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { clearedProxyEnv } from '@deepseek-ai/dsh-http-proxy'
+import { execa } from 'execa'
+import { describe, expect, it } from 'vitest'
+import type { SourceToolEvidence } from '../../../fixtures/source-tool-driver.ts'
+
+const repoRoot = fileURLToPath(new URL('../../../../../../', import.meta.url))
+const dshSourceBin = 'apps/cli/src/bin.ts'
+const sourceToolTimeoutMs = 90_000
+
+describe.skipIf(!existsSync(join(repoRoot, 'apps/cli/lib/bin.js')))('dsh SOURCE tools with prepared runtime artifacts', () => {
+  it('dispatches a source-profile shell call to a result, including sandbox-unavailable hosts, without mixing tools src/lib', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'dsh-source-tool-'))
+    try {
+      const cwd = join(root, 'workspace')
+      await mkdir(cwd)
+      const patch = join(root, 'source-tool.patch.yml')
+      await writeFile(patch, JSON.stringify([
+        { id: 'headless-startup', disabled: true },
+        { id: 'headless-runner', disabled: true },
+        { id: 'llm-deepseek', disabled: true },
+        { id: 'agent-default-model', config: { provider: 'cli-mock', model: 'cli-mock' } },
+        { insert: [
+          {
+            id: 'cli-mock-llm',
+            name: join(repoRoot, 'packages/test-support/loader-smoke/tests/fixtures/cli-mock-llm.ts'),
+          },
+          {
+            id: 'source-tool-driver',
+            name: fileURLToPath(new URL('../../../fixtures/source-tool-driver.ts', import.meta.url)),
+            config: { cwd },
+          },
+        ] },
+      ]))
+      // Source modules and driver stay unbuilt; native and generated runtime artifacts are required.
+      const result = await execa(process.execPath, [
+        '--import', 'tsx/esm', dshSourceBin, '--profile', 'headless', '--patch', patch,
+      ], {
+        cwd: repoRoot,
+        env: {
+          ...clearedProxyEnv(),
+          DSH_HOME: join(root, 'home'),
+          DSH_AGENTS_HOME: join(root, 'agents'),
+          DSH_TELEMETRY_DISABLED: '1',
+          DSH_TOOLS_MODE: 'native',
+          DSH_CLI_MOCK_FAILURE: '0',
+        },
+        input: '',
+        timeout: sourceToolTimeoutMs - 15_000,
+        killSignal: 'SIGKILL',
+        reject: false,
+      })
+      const diagnostic = `stdout:\n${result.stdout}\nstderr:\n${result.stderr}`
+      expect(result.timedOut, diagnostic).toBe(false)
+      expect(result.signal, diagnostic).toBeUndefined()
+      expect(result.exitCode, diagnostic).toBe(0)
+      const records = result.stdout.split('\n').filter(line => line.startsWith('DSH_SOURCE_TOOL_RESULT '))
+      expect(records, diagnostic).toHaveLength(1)
+      const evidence = JSON.parse(records[0]!.slice('DSH_SOURCE_TOOL_RESULT '.length)) as SourceToolEvidence
+      expect(evidence.execArgv).toEqual(['--import', 'tsx/esm'])
+      expect(evidence.errors).toEqual([])
+      for (const pkg of ['tools', 'agent-loop']) {
+        expect(evidence.modules.filter(url => url.endsWith(`/packages/core/${pkg}/src/index.ts`))).toHaveLength(1)
+        expect(evidence.modules.filter(url => url.includes(`/packages/core/${pkg}/lib/`))).toEqual([])
+      }
+      const calls = evidence.events.filter(event => event.type === 'tool/call')
+      expect(calls).toHaveLength(1)
+      expect(calls[0]!.data).toMatchObject({
+        callId: 'cli-smoke-call', name: process.platform === 'win32' ? 'pwsh' : 'bash',
+      })
+      const results = evidence.events.filter(event => event.type === 'tool/result')
+      expect(results).toHaveLength(1)
+      const toolResult = results[0]!.data
+      expect(toolResult.message.content).toHaveLength(1)
+      const block = toolResult.message.content[0]
+      expect(block).toMatchObject({ type: 'tool-result', toolCallId: 'cli-smoke-call' })
+      if (toolResult.error !== undefined) {
+        expect(toolResult.error).toMatchObject({ name: 'SandboxUnavailableError', code: 'SANDBOX_UNAVAILABLE' })
+        expect(block.isError).toBe(true)
+      } else {
+        expect(block.isError).not.toBe(true)
+        expect(block.content.filter(part => part.type === 'text').map(part => part.text).join(''))
+          .toContain('CLI_TOOL_ROUND_TRIP')
+      }
+      expect(evidence.events.filter(event => event.type === 'turn/end').map(event => event.data.reason))
+        .toEqual([{ kind: 'completed' }])
+    } finally {
+      await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+    }
+  }, sourceToolTimeoutMs)
+})
diff --git a/apps/cli/tests/resolved-profile-boot.spec.ts b/apps/cli/tests/resolved-profile-boot.spec.ts
index e968f91504..ff7609c83b 100644
--- a/apps/cli/tests/resolved-profile-boot.spec.ts
+++ b/apps/cli/tests/resolved-profile-boot.spec.ts
@@ -1,12 +1,12 @@
 /** Application-owned profiles share the named profile launch lifecycle. */
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { Context } from '@deepseek-ai/cordis'
 import { createLaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment'
 import {
-  boot, composeEntries, createProfileResolutionGeneration, healIsolatedProfileModuleFallback,
+  boot, composeEntries, createRuntimeResolution,
   PluginPackages, type Profile,
 } from '@deepseek-ai/dsh-app-boot'
 import { installProxyFromEnvironment } from '@deepseek-ai/dsh-http-proxy'
@@ -18,8 +18,7 @@ vi.mock('@deepseek-ai/dsh-app-boot', async (importOriginal) => {
   return {
     ...actual,
     boot: vi.fn(),
-    createProfileResolutionGeneration: vi.fn(actual.createProfileResolutionGeneration),
-    healIsolatedProfileModuleFallback: vi.fn(actual.healIsolatedProfileModuleFallback),
+    createRuntimeResolution: vi.fn(actual.createRuntimeResolution),
     installFailLoud: vi.fn(),
   }
 })
@@ -35,10 +34,8 @@ afterEach(() => {
 
 describe('runProfile with an application-owned profile', () => {
   it.each(
-    (['link', 'runtime'] as const).flatMap(resolutionMode =>
-      (['composition', 'boot', 'watch', 'cleanup', 'tree-cleanup', 'both-cleanups'] as const)
-        .map(stage => ({ resolutionMode, stage }))),
-  )('releases startup resources after a $stage failure in $resolutionMode mode', async ({ resolutionMode, stage }) => {
+    ['composition', 'boot', 'watch', 'cleanup', 'tree-cleanup', 'both-cleanups'] as const,
+  )('releases startup resources after a %s failure', async (stage) => {
     const home = mkdtempSync(join(tmpdir(), 'dsh-profile-startup-failure-'))
     homes.push(home)
     mkdirSync(join(home, 'runtime'))
@@ -62,7 +59,7 @@ describe('runProfile with an application-owned profile', () => {
       await setup?.(ctx)
       throw failure
     })
-    if (stage === 'composition') vi.mocked(createProfileResolutionGeneration).mockRejectedValueOnce(failure)
+    if (stage === 'composition') vi.mocked(createRuntimeResolution).mockRejectedValueOnce(failure)
     const profile: Profile = {
       name: 'desktop', dir: home, patchPath: join(home, 'cordis.patch.yml'),
       patches: [], layers: [],
@@ -70,7 +67,6 @@ describe('runProfile with an application-owned profile', () => {
     try {
       const application = runProfile({
         environment: createLaunchEnvironmentSnapshot([]), profile: 'desktop', patchFiles: [], args: ['--no-open'],
-        resolutionMode,
         resolvedProfile: { profile, installAnchor: join(home, 'runtime/package.json') },
       })
       if (stage === 'both-cleanups') {
@@ -90,12 +86,7 @@ describe('runProfile with an application-owned profile', () => {
     }
   })
 
-  it.each([
-    { selection: 'default', options: {}, mode: 'runtime' },
-    { selection: 'link', options: { resolutionMode: 'link' }, mode: 'link' },
-    { selection: 'dual', options: { resolutionMode: 'dual' }, mode: 'dual' },
-    { selection: 'runtime', options: { resolutionMode: 'runtime' }, mode: 'runtime' },
-  ] as const)('uses shared layers, $selection resolution, and shutdown', async ({ options, mode }) => {
+  it('uses shared layers, runtime resolution, and shutdown', async () => {
     const home = mkdtempSync(join(tmpdir(), 'dsh-resolved-profile-'))
     homes.push(home)
     mkdirSync(join(home, 'runtime'))
@@ -145,25 +136,14 @@ describe('runProfile with an application-owned profile', () => {
     const runtime = { profile, installAnchor: join(home, 'runtime/package.json') }
     try {
       const { shutdown } = await runProfile({
-        environment, profile: 'desktop', resolvedProfile: runtime, ...options,
+        environment, profile: 'desktop', resolvedProfile: runtime,
         patchFiles: [overlay], args: ['--port', '0', '--no-open'],
       })
       expect(installProxyFromEnvironment).toHaveBeenCalledWith(environment, expect.any(Function))
-      if (mode !== 'runtime') {
-        expect(healIsolatedProfileModuleFallback).toHaveBeenCalledWith({ profile, installAnchor: runtime.installAnchor })
-      } else {
-        expect(healIsolatedProfileModuleFallback).not.toHaveBeenCalled()
-      }
-      const generation = vi.mocked(createProfileResolutionGeneration).mock.settledResults
+      const resolution = vi.mocked(createRuntimeResolution).mock.settledResults
         .find(result => result.type === 'fulfilled')?.value
-      expect(generation?.profileDir).toBe(home)
-      expect(plugin).toHaveBeenCalledWith(PluginPackages, mode === 'link' ? {} : {
-        generation,
-        behavior: mode === 'dual' ? 'verify' : 'enforce',
-      })
-      expect(existsSync(join(home, 'profiles/node_modules'))).toBe(false)
-      expect(existsSync(join(home, '.dsh-module-fallback'))).toBe(mode !== 'runtime')
-      expect(existsSync(join(home, 'node_modules/test-runtime'))).toBe(mode !== 'runtime')
+      expect(resolution?.profileDir).toBe(home)
+      expect(plugin).toHaveBeenCalledWith(PluginPackages, { resolution })
       expect(lstatSync(localPackageDir).isDirectory()).toBe(true)
       expect(readFileSync(join(localPackageDir, 'package.json'), 'utf8')).toBe(localManifest)
       const requireFromProfile = createRequire(join(home, 'package.json'))
diff --git a/apps/cli/tests/source-launch.compat.spec.ts b/apps/cli/tests/source-launch.compat.spec.ts
index 975e4c3591..9bdd5f353a 100644
--- a/apps/cli/tests/source-launch.compat.spec.ts
+++ b/apps/cli/tests/source-launch.compat.spec.ts
@@ -2,21 +2,21 @@ import { readFile } from 'node:fs/promises'
 import { fileURLToPath } from 'node:url'
 import { execa } from 'execa'
 import { describe, expect, it } from 'vitest'
+import { testProfileResolution } from './profiles/headless/tests/profile-resolution.ts'
 
 /**
- * Keyless smoke for SOURCE `dsh` execution: run `apps/cli/src/bin.ts`
- * with the exact production runtime vector (`node --import tsx/esm`, the
- * vector the root `dsh` script invokes directly) and assert the
- * required-config diagnostic. The Node compatibility matrix runs this
- * WHOLE file, so a Node release changing module hooks or TypeScript handling
- * breaks this gate instead of every developer's `pnpm dsh`; the built-bin
- * suite covers the published `lib/` entry, not this source chain.
+ * Keyless source-launch and profile-resolution checks through the production
+ * tsx ESM-only entry. The Node compatibility matrix runs this file without a
+ * build; source tool execution with native/generated dependencies belongs to
+ * the build-backed source-tool suite.
  */
 
 const repoRoot = fileURLToPath(new URL('../../../', import.meta.url))
 const dshSourceBin = 'apps/cli/src/bin.ts'
 
 describe('dsh SOURCE launcher (node --import tsx/esm)', () => {
+  testProfileResolution('src')
+
   it('launches the source CLI without building', async () => {
     const rootPackage = JSON.parse(await readFile(new URL('../../../package.json', import.meta.url), 'utf8')) as {
       readonly scripts?: Record<string, string>
diff --git a/apps/cli/tests/web-agent-presets.e2e.ts b/apps/cli/tests/web-agent-presets.e2e.ts
index 0565a19700..692cad3ebd 100644
--- a/apps/cli/tests/web-agent-presets.e2e.ts
+++ b/apps/cli/tests/web-agent-presets.e2e.ts
@@ -7,7 +7,7 @@ import { Context } from '@deepseek-ai/cordis'
 import {
   boot,
   initProfile,
-  createProfileResolutionGeneration,
+  createRuntimeResolution,
   loadOverlayPatches,
   loadProfile,
   PluginPackages,
@@ -35,7 +35,7 @@ const BASE_PATCH = join(REPO_ROOT, 'packages/bundle/base/cordis.patch.yml')
 const WEB_PATCH = join(REPO_ROOT, 'packages/bundle/web-app/cordis.patch.yml')
 const CODEX_PACKAGE_DIR = join(REPO_ROOT, 'packages/subagent/subagent-codex')
 const CLAUDE_CODE_PACKAGE_DIR = join(REPO_ROOT, 'packages/subagent/subagent-claude-code')
-/** The installation anchor whose dependency surface the preset module fallback mirrors. */
+/** The installation anchor whose dependency surface the runtime resolution mirrors. */
 const INSTALL_ANCHOR = join(REPO_ROOT, 'apps/cli/package.json')
 const MINIMAL_PROMPT = 'You are a helpful software engineer assistant.'
 const MINIMAL_BASH_DESCRIPTION = `Run commands in a bash shell
@@ -156,7 +156,7 @@ async function bootWeb(
     profile = loadProfile('dsh-test', 'spec', INSTALL_ANCHOR, home, { userLayer: false })
     bundlePatches = profile.layers.flatMap(layer => layer.patches)
   }
-  const resolution = await createProfileResolutionGeneration({ installAnchor: INSTALL_ANCHOR, home, profile })
+  const resolution = await createRuntimeResolution({ installAnchor: INSTALL_ANCHOR, home, profile })
   const rootConfig = join(profileDir, 'cordis.yml')
   await writeFile(rootConfig, '[]\n')
   return await boot('dsh-test', rootConfig, [...bundlePatches, ...overrides], async (bootCtx) => {
@@ -164,7 +164,7 @@ async function bootWeb(
       installAnchor: INSTALL_ANCHOR, home, cwd: home,
       startedBundles: profileBundles ?? ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'],
       overlays: overrides, telemetryDisabledEnv: '1' })
-    await bootCtx.plugin(PluginPackages, { generation: resolution })
+    await bootCtx.plugin(PluginPackages, { resolution })
     bootCtx.provide('connection', {
       fetch: { register: () => () => {} },
       rpc: { intercept: () => () => {} },
diff --git a/apps/desktop-host/src/index.ts b/apps/desktop-host/src/index.ts
index 573ef11541..3964a53291 100644
--- a/apps/desktop-host/src/index.ts
+++ b/apps/desktop-host/src/index.ts
@@ -18,18 +18,17 @@ async function main(): Promise<void> {
   const application = runProfile({
     environment: loadLayeredEnv('dsh'),
     profile: 'desktop',
-    resolutionMode: process.argv[5] === 'runtime' ? 'runtime' : 'link',
     resolvedProfile: { profile, installAnchor },
     patchFiles: [],
     args: ['--no-open', '--port', '19387'],
-    ...(process.argv[6] === undefined ? {} : {
+    ...(process.argv[5] === undefined ? {} : {
       packageManager: {
         command: process.execPath,
-        args: ['--expose-internals', process.argv[6]],
+        args: ['--expose-internals', process.argv[5]],
         env: {
           ELECTRON_RUN_AS_NODE: '1',
           DSH_DESKTOP_NODE_EXECUTABLE: process.execPath,
-          PATH: `${process.argv[7] ?? ''}${delimiter}${process.env.PATH ?? ''}`,
+          PATH: `${process.argv[6] ?? ''}${delimiter}${process.env.PATH ?? ''}`,
         },
       },
     }),
diff --git a/apps/desktop/README.i18n.yaml b/apps/desktop/README.i18n.yaml
index a8ad165603..455501862e 100644
--- a/apps/desktop/README.i18n.yaml
+++ b/apps/desktop/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/desktop/README.md
-README.md: 952f2529b4922863603549c0829fc37e57c0851e
-README.zh.md: a38ac6e86d77bca423eb54320cca46fa5f435ec6
+README.md: 6c9a6a8784732e6fa1369df5632391b789786b22
+README.zh.md: a0f2184d911eeab46902670cf992b6847e2bca31
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index 952f2529b4..6c9a6a8784 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -63,7 +63,7 @@ On macOS the custom application menu also declares the standard File, Window, an
 The signed `resources/app.asar/dsh/desktop-runtime.json` binds the shell version, Electron's Node version, platform, architecture, shared package versions, and final file inventory. Startup reads the metadata and checks shared package records. Release schema, shell version, target compatibility, and file integrity are verified during packaging. Core packages are never copied into profile storage or installed by pnpm at first launch.
 
 1. The main window displays the shared Web loading page from packaged static assets before profile preparation or backend startup. Shared profile initialization creates missing manifest, empty user patch, and pnpm workspace files without overwriting existing files.
-2. Before production Host startup, Desktop removes profile copies and fallback links for packages listed by the current runtime or the recorded Desktop package set. It removes their dependency declarations and overrides, and discards the lockfile when cleanup changes package state. Other plugin files, configuration, and versions remain; development skips this cleanup and startup never runs pnpm.
+2. Before Host startup, Desktop validates the runtime descriptor and prepares the profile without modifying installed packages, declarations, or the lockfile; it removes only the `.dsh-module-fallback` projections earlier link-backend launches wrote, and startup never runs pnpm. Packages inside the profile keep native precedence, and installation package names resolve through the runtime resolution ([lookup order](../../.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.md); [cleanup removal](../../.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.md)).
 3. Changes to Electron's Node version, platform, or architecture preserve installed plugins. Native incompatibilities surface during loading and can be repaired through pnpm.
 4. The main application’s Plugins page uses the shared [plugin manager](../../packages/boot/plugin-manager/README.md) against the Desktop profile. Package operations use bundled pnpm with normal user and profile configuration.
 5. The shared manager owns installation errors, activation, and restart requirements. Native recovery can disable third-party bundles even when the Host cannot start.
diff --git a/apps/desktop/README.zh.md b/apps/desktop/README.zh.md
index a38ac6e86d..a0f2184d91 100644
--- a/apps/desktop/README.zh.md
+++ b/apps/desktop/README.zh.md
@@ -63,7 +63,7 @@ macOS 上自定义应用菜单还会声明标准的 File、Window 和应用菜
 签名资源中的 `resources/app.asar/dsh/desktop-runtime.json` 绑定 shell 版本、Electron 的 Node 版本、平台、架构、共享包版本和最终文件清单。启动读取元数据，并检查共享包记录。发布 schema、shell 版本、目标兼容性和文件完整性在打包时验证。首次启动不会把核心包复制到 profile 存储或通过 pnpm 安装核心包。
 
 1. 主窗口在 profile 准备或后端启动前，从打包静态资源显示共享 Web 加载页。共享 profile 初始化创建缺失的 manifest、空用户 patch 与 pnpm workspace 文件，不覆盖现有文件。
-2. 生产版在启动 Host 前，清理当前运行包清单或已记录 Desktop 包清单中各包的 profile 副本和回退链接，同时删除对应依赖声明与 overrides；清理改变包状态时丢弃锁文件。其他插件文件、配置和版本保留；开发模式跳过此清理，启动时不运行 pnpm。
+2. 启动 Host 前，Desktop 校验运行时描述符并准备 profile，不改动已安装的包、依赖声明与锁文件；只删除早期 Link 后端启动写下的 `.dsh-module-fallback` 投影，启动从不运行 pnpm。profile 内的包保持原生优先级，本体包名通过 runtime resolution 解析（[查找顺序](../../.agents/notes/implemented/architecture/2026-09-19-profile-resolution-lookup-order.zh.md)；[清理移除](../../.agents/notes/implemented/simplification/2026-09-19-remove-desktop-profile-core-cleanup.zh.md)）。
 3. Electron 的 Node 版本、平台或架构变化时保留已安装插件。原生兼容性问题在加载时报错，可通过 pnpm 修复。
 4. 主应用的“插件”页面通过共享[插件管理器](../../packages/boot/plugin-manager/README.zh.md)操作 Desktop profile。包操作使用内置 pnpm 及正常的用户和 profile 配置。
 5. 共享管理器负责安装错误、激活和重启要求。即使 Host 无法启动，原生恢复仍可禁用第三方 bundle。
@@ -76,7 +76,6 @@ macOS 上自定义应用菜单还会声明标准的 File、Window 和应用菜
 
 恢复操作等待 Host 关闭后才修改插件启用状态。原生恢复操作在 profile 事务锁内调用共享 app-boot 恢复函数。它禁用第三方 bundle，并将 profile 的 `cordis.patch.yml` 重命名为 `cordis.patch.yml.bak-<timestamp>`（重名时追加序号），无需解析；下次启动创建空 patch。已安装包和已有备份保留。home 级 patch 不变。Electron 控制台记录备份路径（或原文件不存在）以及 home 级 patch 未修改。profile 数据无效、重命名失败或写入失败会作为恢复操作错误报告；已完成的修改保留，Desktop 不会假装恢复成功后重启。Desktop 不提供 profile 重置操作或应急 HTML 文档。
 
-包事务独占 `$DSH_HOME/profiles/desktop/lock`，直到 pnpm 进程退出。pnpm 运行前，共享模块回退辅助函数只删除其拥有的链接，保留 pnpm 管理的目录；开发 Host 在启动时重建所需链接。链接清理保留目标目录。原生构建遵循 pnpm 配置的构建策略；发布准备使用独立的构建期允许列表。
 
 ## 开发
 
diff --git a/apps/desktop/scripts/smoke-runtime.ts b/apps/desktop/scripts/smoke-runtime.ts
index f3697cf521..06768be372 100644
--- a/apps/desktop/scripts/smoke-runtime.ts
+++ b/apps/desktop/scripts/smoke-runtime.ts
@@ -21,7 +21,7 @@ export async function smokeDesktopRuntime(
   const home = mkdtempSync(join(tmpdir(), 'dsh-desktop-smoke-'))
   const profile = join(home, 'profiles', 'desktop')
   const host = new DesktopHostProcess(node, root, profile, undefined, { ...environment, DSH_HOME: home },
-    undefined, join(resourcesRuntime, 'primary-runtime'), 'runtime',
+    undefined, join(resourcesRuntime, 'primary-runtime'),
     { pnpm: join(resourcesRuntime, 'pnpm', 'bin', 'pnpm.cjs'), nodeBin: join(resourcesRuntime, 'bin') })
   let timer: ReturnType<typeof setTimeout> | undefined
   try {
diff --git a/apps/desktop/src/host-process.ts b/apps/desktop/src/host-process.ts
index e4be343c99..6b611abb79 100644
--- a/apps/desktop/src/host-process.ts
+++ b/apps/desktop/src/host-process.ts
@@ -91,7 +91,6 @@ export class DesktopHostProcess {
    * @param primaryRuntime - Optional bundled dependency payload; when supplied, missing sibling
    *   `office-skills` resources fail Host startup.
    * @param packageManager - Bundled pnpm entry and Node launcher directory, scoped to package operations.
-   * @param profileResolution - Package resolution mode for the application-owned profile.
    */
   constructor(
     private readonly node: string,
@@ -101,7 +100,6 @@ export class DesktopHostProcess {
     private readonly environment: NodeJS.ProcessEnv = process.env,
     private readonly onFailure?: (error: Error) => void,
     private readonly primaryRuntime?: string,
-    private readonly profileResolution: 'link' | 'runtime' = 'link',
     private readonly packageManager?: { readonly pnpm: string; readonly nodeBin: string },
   ) {}
 
@@ -119,7 +117,6 @@ export class DesktopHostProcess {
       this.runtimeDir,
       this.projectDir,
       this.primaryRuntime ?? join(this.runtimeDir, '..', 'runtime', 'primary-runtime'),
-      this.profileResolution,
       ...this.packageManager === undefined ? [] : [this.packageManager.pnpm, this.packageManager.nodeBin],
     ], {
       cwd: this.projectDir,
diff --git a/apps/desktop/src/ipc.ts b/apps/desktop/src/ipc.ts
index e78db93fee..f5f1f6e82e 100644
--- a/apps/desktop/src/ipc.ts
+++ b/apps/desktop/src/ipc.ts
@@ -11,6 +11,7 @@ export const DESKTOP_IPC = {
   updatesOpen: 'dsh-desktop:updates-open',
   updatesPresentation: 'dsh-desktop:updates-presentation',
   nativeThemeSet: 'dsh-desktop:native-theme-set',
+  windowFullscreen: 'dsh-desktop:window-fullscreen',
   windowsAppearance: 'dsh-desktop:windows-appearance',
   windowsMenu: 'dsh-desktop:windows-menu',
 } as const
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index ecf81b2e29..e5aa563c6e 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -111,8 +111,8 @@ function developmentHostInspectPort(enabled: boolean): number | undefined {
 function createWindow(preload: string, show = false, primary = false): BrowserWindow {
   const window = new BrowserWindow({
     width: 1280,
-    height: 840,
-    minWidth: 880,
+    height: 820,
+    minWidth: 520,
     minHeight: 600,
     show,
     ...(process.platform === 'win32' && primary ? {
@@ -143,6 +143,18 @@ function createWindow(preload: string, show = false, primary = false): BrowserWi
     if (['http:', 'https:'].includes(new URL(url).protocol)) void shell.openExternal(url)
     return { action: 'deny' }
   })
+  if (process.platform === 'darwin') {
+    // macOS hides the traffic lights in fullscreen; the page drops its
+    // clearance for them off the html[data-fullscreen] flag this feeds.
+    const sendFullscreen = (): void => {
+      if (!window.isDestroyed()) window.webContents.send(DESKTOP_IPC.windowFullscreen, window.isFullScreen())
+    }
+    window.on('enter-full-screen', sendFullscreen)
+    window.on('leave-full-screen', sendFullscreen)
+    // Reloads and navigations re-register the preload listener; resend the
+    // current state so a fullscreen reload does not fall back to windowed CSS.
+    window.webContents.on('did-finish-load', sendFullscreen)
+  }
   window.webContents.on('context-menu', (_event, { isEditable, selectionText, editFlags }) => {
     const items: MenuItemConstructorOptions[] = []
     if (isEditable) {
@@ -251,7 +263,7 @@ async function main(): Promise<void> {
       hostInspectPort, process.env, onFailure,
       development ? join(app.getAppPath(), '.desktop-build', 'targets', `${process.platform === 'darwin' ? 'mac' : 'win'}-${process.arch}`, 'runtime', 'primary-runtime')
         : join(process.resourcesPath, 'runtime', 'primary-runtime'),
-      development ? 'link' : 'runtime', resources)
+      resources)
     return {
       start: async () => {
         const ready = await host.start()
@@ -326,7 +338,7 @@ async function main(): Promise<void> {
     startup ??= (async () => {
       await navigateMain(applicationUrl)
       await backend.start(async () => {
-        await manager.applyRelease(app.isPackaged)
+        await manager.applyRelease()
       })
       if (backend.host !== undefined) updateJournal?.action('workspace-ready')
       // The existing Web document resumes through the boot IPC response.
diff --git a/apps/desktop/src/preload-app.ts b/apps/desktop/src/preload-app.ts
index 26b7334707..10ea92326f 100644
--- a/apps/desktop/src/preload-app.ts
+++ b/apps/desktop/src/preload-app.ts
@@ -2,7 +2,7 @@
 
 import { contextBridge, ipcRenderer } from 'electron'
 import { DESKTOP_IPC, SCHEME, type DshDesktopProductApi, type DesktopUpdatePresentation } from './ipc.ts'
-import { markDocumentPlatform } from './preload-platform.ts'
+import { markDocumentPlatform, syncWindowFullscreen } from './preload-platform.ts'
 import { syncNativeTheme } from './preload-theme.ts'
 import { syncWindowsAppearance } from './preload-windows.ts'
 
@@ -31,6 +31,7 @@ if (location.protocol === `${SCHEME}:` && location.hostname === 'app') {
 }
 
 markDocumentPlatform()
+syncWindowFullscreen()
 syncNativeTheme()
 // Main-process IPC also verifies the owning window and top frame.
 contextBridge.exposeInMainWorld('dshDesktop', location.protocol === `${SCHEME}:` && location.hostname === 'app' ? product : { protocolVersion: 1 })
diff --git a/apps/desktop/src/preload-platform.ts b/apps/desktop/src/preload-platform.ts
index 9fe13c4b2e..0ce5c82ef8 100644
--- a/apps/desktop/src/preload-platform.ts
+++ b/apps/desktop/src/preload-platform.ts
@@ -1,5 +1,8 @@
 /** Marks the document root with the host platform so shared Web UI CSS can scope desktop-only rules. */
 
+import { ipcRenderer } from 'electron'
+import { DESKTOP_IPC } from './ipc.ts'
+
 /**
  * Sets `data-platform` (e.g. `darwin`) on `<html>`, deferring to DOMContentLoaded
  * when the preload runs before the document root exists.
@@ -12,3 +15,18 @@ export function markDocumentPlatform(): void {
   if (root === null) window.addEventListener('DOMContentLoaded', mark)
   else mark()
 }
+
+/**
+ * Mirrors the window's macOS fullscreen state onto `<html data-fullscreen>` so
+ * CSS drops the traffic-light clearance while the lights are hidden. The main
+ * process sends the state on every transition and after each load.
+ */
+export function syncWindowFullscreen(): void {
+  if (process.platform !== 'darwin') return
+  ipcRenderer.on(DESKTOP_IPC.windowFullscreen, (_event, fullscreen: boolean) => {
+    const root = document.documentElement as HTMLElement | null
+    if (root === null) return
+    if (fullscreen) root.dataset.fullscreen = 'true'
+    else delete root.dataset.fullscreen
+  })
+}
diff --git a/apps/desktop/src/profile-core-cleanup.ts b/apps/desktop/src/profile-core-cleanup.ts
deleted file mode 100644
index 9bdf5c9e54..0000000000
--- a/apps/desktop/src/profile-core-cleanup.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-/** Remove application-owned packages left in external plugin profiles before production boot. */
-
-import { existsSync, lstatSync, readFileSync, rmSync, unlinkSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { dump, load } from 'js-yaml'
-import { DESKTOP_PACKAGE_SET_FILE, readDesktopCorePackageSet } from './core-package-set.ts'
-
-/** Enables the temporary production-profile cleanup; remove this module and its caller together. */
-const CLEAN_PROFILE_CORE_PACKAGES = true
-
-function object(value: unknown): Record<string, unknown> {
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-    throw new Error('desktop profile cleanup: expected an object')
-  }
-  return value as Record<string, unknown>
-}
-
-function stat(path: string): ReturnType<typeof lstatSync> | undefined {
-  try { return lstatSync(path) } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-    return undefined
-  }
-}
-
-function remove(path: string): boolean {
-  const entry = stat(path)
-  if (entry === undefined) return false
-  if (entry.isSymbolicLink()) unlinkSync(path)
-  else rmSync(path, { recursive: entry.isDirectory() })
-  return true
-}
-
-function requireDirectory(path: string): void {
-  const entry = stat(path)
-  if (entry !== undefined && (!entry.isDirectory() || entry.isSymbolicLink())) {
-    throw new Error(`desktop profile cleanup: package parent is not a real directory: ${path}`)
-  }
-}
-
-function prune(value: Record<string, unknown>, field: string, names: ReadonlySet<string>): boolean {
-  if (value[field] === undefined) return false
-  const entries = object(value[field])
-  let changed = false
-  for (const name of names) {
-    if (!Object.hasOwn(entries, name)) continue
-    Reflect.deleteProperty(entries, name)
-    changed = true
-  }
-  return changed
-}
-
-/**
- * Delete current and recorded Desktop core packages, their declarations, and stale lockfile resolutions.
- * Managed links are unlinked without touching their targets; unrelated plugins and profile configuration survive.
- * The caller holds the profile lock and must not have started the Host. Development launches do nothing.
- * @param profile - Absolute Desktop profile directory.
- * @param packageNames - Package names from the verified application runtime descriptor.
- * @param production - Whether this launch uses the packaged application.
- */
-export function cleanProfileCorePackages(profile: string, packageNames: readonly string[], production: boolean): void {
-  // oxlint-disable-next-line typescript/no-unnecessary-condition -- release cleanup has an explicit source switch.
-  if (!CLEAN_PROFILE_CORE_PACKAGES || !production || !existsSync(profile)) return
-  const names = new Set(packageNames)
-  const recordPath = join(profile, DESKTOP_PACKAGE_SET_FILE)
-  if (existsSync(recordPath)) {
-    for (const entry of readDesktopCorePackageSet(profile).packages) names.add(entry.name)
-  }
-  const roots = [join(profile, 'node_modules'), join(profile, '.dsh-module-fallback', 'node_modules')]
-  requireDirectory(join(profile, '.dsh-module-fallback'))
-  for (const root of roots) {
-    requireDirectory(root)
-    for (const name of names) requireDirectory(dirname(join(root, name)))
-  }
-  const manifestPath = join(profile, 'package.json')
-  const manifest = existsSync(manifestPath) ? object(JSON.parse(readFileSync(manifestPath, 'utf8'))) : undefined
-  const workspacePath = join(profile, 'pnpm-workspace.yaml')
-  const workspace = existsSync(workspacePath) ? object(load(readFileSync(workspacePath, 'utf8'))) : undefined
-  let manifestChanged = false
-  if (manifest !== undefined) {
-    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
-      manifestChanged = prune(manifest, field, names) || manifestChanged
-    }
-    if (manifest.pnpm !== undefined) manifestChanged = prune(object(manifest.pnpm), 'overrides', names) || manifestChanged
-  }
-  const workspaceChanged = workspace !== undefined && prune(workspace, 'overrides', names)
-  const packageResidue = roots.some(root => [...names].some(name => stat(join(root, name)) !== undefined))
-  if (manifestChanged || workspaceChanged || packageResidue) remove(join(profile, 'pnpm-lock.yaml'))
-  if (manifestChanged) writeFileSync(manifestPath, `${JSON.stringify(manifest, undefined, 2)}\n`)
-  if (workspaceChanged) writeFileSync(workspacePath, dump(workspace))
-  for (const root of roots) for (const name of names) remove(join(root, name))
-}
diff --git a/apps/desktop/src/profile-packages.ts b/apps/desktop/src/profile-packages.ts
deleted file mode 100644
index bf9d98e0a3..0000000000
--- a/apps/desktop/src/profile-packages.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-/** One-time removal of package links recorded by Desktop profile management. */
-
-import { lstatSync, readFileSync, readlinkSync, unlinkSync } from 'node:fs'
-import { dirname, isAbsolute, join, resolve } from 'node:path'
-
-/** Legacy Desktop package-link ownership file. */
-export const DESKTOP_PROFILE_STATE = 'desktop-runtime-state.json'
-
-interface DesktopPackageLink {
-  readonly name: string
-  readonly target: string
-}
-
-const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)$/u
-
-function record(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-function stat(path: string): ReturnType<typeof lstatSync> | undefined {
-  try { return lstatSync(path) } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-    return undefined
-  }
-}
-
-/**
- * Remove recorded links still owned by Desktop and delete their legacy state file.
- * Installed directories, changed links, and links beneath redirected package directories are retained.
- * @param profile - Desktop profile directory.
- */
-export function migrateDesktopProfileLinks(profile: string): void {
-  const statePath = join(profile, DESKTOP_PROFILE_STATE)
-  if (stat(statePath) === undefined) return
-  const value: unknown = JSON.parse(readFileSync(statePath, 'utf8'))
-  if (!record(value) || !Array.isArray(value.links)) throw new Error('desktop profile: invalid legacy package links')
-  const links = value.links.map((link: unknown): DesktopPackageLink => {
-    if (!record(link) || typeof link.name !== 'string' || !PACKAGE_NAME.test(link.name)
-      || typeof link.target !== 'string' || !isAbsolute(link.target)) {
-      throw new Error('desktop profile: invalid legacy package link')
-    }
-    return { name: link.name, target: link.target }
-  })
-  const modules = join(profile, 'node_modules')
-  if (stat(modules)?.isDirectory() === true) {
-    for (const link of links) {
-      const path = join(modules, link.name)
-      if (dirname(path) !== modules && stat(dirname(path))?.isDirectory() !== true) continue
-      if (stat(path)?.isSymbolicLink() === true
-        && resolve(dirname(path), readlinkSync(path)) === resolve(link.target)) {
-        unlinkSync(path)
-      }
-    }
-  }
-  unlinkSync(statePath)
-}
diff --git a/apps/desktop/src/project-manager.ts b/apps/desktop/src/project-manager.ts
index af7804e1a5..270d87d6b2 100644
--- a/apps/desktop/src/project-manager.ts
+++ b/apps/desktop/src/project-manager.ts
@@ -23,10 +23,8 @@ import type { DesktopPaths } from './paths.ts'
 import type { DesktopRelease } from './release.ts'
 import { readDesktopRuntime } from './runtime-tree.ts'
 import {
-  initProfile, PROFILE_TEMPLATES, sanitizeProfile, type ProfileTemplate,
+  initProfile, PROFILE_TEMPLATES, removeLinkProjections, sanitizeProfile, type ProfileTemplate,
 } from '@deepseek-ai/dsh-app-boot'
-import { migrateDesktopProfileLinks } from './profile-packages.ts'
-import { cleanProfileCorePackages } from './profile-core-cleanup.ts'
 
 const PROJECT_NAME = '@deepseek-ai/dsh-desktop-runtime'
 const DSH_PACKAGE = '@deepseek-ai/dsh'
@@ -81,15 +79,14 @@ export class DesktopProjectManager {
 
   /**
    * Load application metadata and prepare the external plugin profile without installing packages.
-   * @param production - Remove application-owned profile packages before packaged Host startup.
    */
-  async applyRelease(production = false): Promise<void> {
+  async applyRelease(): Promise<void> {
     await this.withLock(() => {
-      const descriptor = readDesktopRuntime(this.runtime.dsh)
-      cleanProfileCorePackages(this.paths.profile, descriptor.sharedPackages.map(entry => entry.name), production)
+      // Validation only: an unreadable or mismatched runtime descriptor stops preparation before the Host starts.
+      readDesktopRuntime(this.runtime.dsh)
       migrateProfileSettings(this.paths.profile)
-      migrateDesktopProfileLinks(this.paths.profile)
       createPluginProfile(this.paths.profile)
+      removeLinkProjections(this.paths.profile)
     })
   }
 
diff --git a/apps/desktop/tests/fixtures/workspace-update-adapters.mjs b/apps/desktop/tests/fixtures/workspace-update-adapters.mjs
index 8b9a735282..995eb6e753 100644
--- a/apps/desktop/tests/fixtures/workspace-update-adapters.mjs
+++ b/apps/desktop/tests/fixtures/workspace-update-adapters.mjs
@@ -17,9 +17,9 @@ export class DesktopHostProcess extends Host {
     fixture.taskQueries.push({ at: Date.now(), action, active: result })
     return result
   }
-  constructor(node, runtime, project, _inspectPort, environment, onFailure) {
+  constructor(node, runtime, project, _inspectPort, environment, onFailure, primaryRuntime, packageManager) {
     // Port zero lets the OS allocate the development inspector; no fixed listener is acquired.
-    super(node, runtime, project, 0, environment, onFailure)
+    super(node, runtime, project, 0, environment, onFailure, primaryRuntime, packageManager)
     fixture.host = this
   }
   async start() {
diff --git a/apps/desktop/tests/host-process.spec.ts b/apps/desktop/tests/host-process.spec.ts
index 45f5d4d9c5..dc678e2fa5 100644
--- a/apps/desktop/tests/host-process.spec.ts
+++ b/apps/desktop/tests/host-process.spec.ts
@@ -110,15 +110,15 @@ describe('desktop host process', () => {
     expect(failure).not.toHaveBeenCalled()
   })
 
-  it('passes external dependencies and runtime profile resolution to the Host', async () => {
+  it('passes external dependencies and package-manager paths to the Host', async () => {
     const runtime = projectWithHost(HTTP_HOST.replace('runtime: process.argv[2]',
-      'pnpm: process.argv[6], nodeBin: process.argv[7], primaryRuntime: process.argv[4], profileResolution: process.argv[5], runtime: process.argv[2]'))
+      'pnpm: process.argv[5], nodeBin: process.argv[6], primaryRuntime: process.argv[4], runtime: process.argv[2]'))
     const primaryRuntime = join(runtime, 'external-primary-runtime')
     const host = new DesktopHostProcess(process.execPath, runtime, runtime, undefined, process.env,
-      undefined, primaryRuntime, 'runtime', { pnpm: join(runtime, 'pnpm.mjs'), nodeBin: join(runtime, 'bin') })
+      undefined, primaryRuntime, { pnpm: join(runtime, 'pnpm.mjs'), nodeBin: join(runtime, 'bin') })
     hosts.push(host)
     const { url } = await host.start()
-    expect(await (await fetch(url)).json()).toMatchObject({ primaryRuntime, profileResolution: 'runtime', pnpm: join(runtime, 'pnpm.mjs'), nodeBin: join(runtime, 'bin') })
+    expect(await (await fetch(url)).json()).toMatchObject({ primaryRuntime, pnpm: join(runtime, 'pnpm.mjs'), nodeBin: join(runtime, 'bin') })
   })
 
   it('reports a fatal event after readiness once', async () => {
diff --git a/apps/desktop/tests/main-startup.spec.ts b/apps/desktop/tests/main-startup.spec.ts
index 2d49a39638..eaab0da9df 100644
--- a/apps/desktop/tests/main-startup.spec.ts
+++ b/apps/desktop/tests/main-startup.spec.ts
@@ -74,6 +74,8 @@ const harness = await vi.hoisted(async () => {
       super(); if (windowFailure !== undefined) throw windowFailure; windows.push(this); if (options.modal) policyBlocked.resolve()
     }
     isDestroyed() { return this.destroyed }
+    fullscreen = false
+    isFullScreen() { return this.fullscreen }
     isMinimized() { return false }
     isFocused() { return true }
     async loadURL(url: string) {
@@ -108,7 +110,7 @@ const harness = await vi.hoisted(async () => {
     constructor(
       readonly node: string, readonly runtime: string, readonly profile: string,
       readonly inspectPort?: number, readonly environment?: NodeJS.ProcessEnv, readonly onFailure?: (error: Error) => void,
-      readonly primaryRuntime?: string, readonly profileResolution?: string,
+      readonly primaryRuntime?: string,
       readonly packageManager?: { pnpm: string; nodeBin: string },
     ) { hosts.push(this) }
   }
@@ -552,6 +554,39 @@ describe('desktop main startup', () => {
     expect(harness.hosts).toHaveLength(0)
   })
 
+  it('relays the macOS fullscreen state on transitions and after each load', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    await import('../src/main.ts')
+    await harness.preparing.promise
+    const window = harness.windows[0]!
+    const sent = () => window.webContents.send.mock.calls.filter(([channel]) => channel === DESKTOP_IPC.windowFullscreen)
+    expect(sent()).toHaveLength(0)
+    window.fullscreen = true
+    window.emit('enter-full-screen')
+    expect(sent().at(-1)).toEqual([DESKTOP_IPC.windowFullscreen, true])
+    // A reload re-registers the preload listener; the finished load resends
+    // the current state so fullscreen CSS survives the reload.
+    window.webContents.emit('did-finish-load')
+    expect(sent().at(-1)).toEqual([DESKTOP_IPC.windowFullscreen, true])
+    window.fullscreen = false
+    window.emit('leave-full-screen')
+    expect(sent().at(-1)).toEqual([DESKTOP_IPC.windowFullscreen, false])
+    const relayed = sent().length
+    window.destroyed = true
+    window.emit('enter-full-screen')
+    expect(sent()).toHaveLength(relayed)
+  })
+
+  it.each(['win32', 'linux'] as const)('registers no fullscreen relay on %s', async (platform) => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    await import('../src/main.ts')
+    await harness.preparing.promise
+    const window = harness.windows[0]!
+    window.emit('enter-full-screen')
+    window.webContents.emit('did-finish-load')
+    expect(window.webContents.send.mock.calls.filter(([channel]) => channel === DESKTOP_IPC.windowFullscreen)).toHaveLength(0)
+  })
+
   it('follows the Windows primary document language and palette without trusting other frames', async () => {
     vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
     await import('../src/main.ts')
@@ -1356,7 +1391,6 @@ describe('desktop main startup', () => {
       node: process.execPath,
       runtime: join(harness.app.getAppPath(), 'dsh'),
       primaryRuntime: join('desktop-test-resources', 'runtime', 'primary-runtime'),
-      profileResolution: 'runtime',
       profile: 'desktop-test-profile',
     })
     expect(harness.hosts[0]!.environment).toBe(process.env)
diff --git a/apps/desktop/tests/preload-app.spec.ts b/apps/desktop/tests/preload-app.spec.ts
index 0af35e98c5..b095aae2c0 100644
--- a/apps/desktop/tests/preload-app.spec.ts
+++ b/apps/desktop/tests/preload-app.spec.ts
@@ -7,7 +7,7 @@ const electron = vi.hoisted(() => ({
   ipcRenderer: { invoke: vi.fn(), on: vi.fn(), off: vi.fn(), send: vi.fn() },
 }))
 vi.mock('electron', () => electron)
-vi.mock('../src/preload-platform.ts', () => ({ markDocumentPlatform: vi.fn() }))
+vi.mock('../src/preload-platform.ts', () => ({ markDocumentPlatform: vi.fn(), syncWindowFullscreen: vi.fn() }))
 vi.mock('../src/preload-theme.ts', () => ({ syncNativeTheme: vi.fn() }))
 vi.mock('../src/preload-windows.ts', () => ({ syncWindowsAppearance: vi.fn() }))
 
diff --git a/apps/desktop/tests/preload-platform.client.spec.ts b/apps/desktop/tests/preload-platform.client.spec.ts
new file mode 100644
index 0000000000..fbf6902db0
--- /dev/null
+++ b/apps/desktop/tests/preload-platform.client.spec.ts
@@ -0,0 +1,33 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from 'vitest'
+import { DESKTOP_IPC } from '../src/ipc.ts'
+import { syncWindowFullscreen } from '../src/preload-platform.ts'
+
+const on = vi.hoisted(() => vi.fn())
+vi.mock('electron', () => ({ ipcRenderer: { on } }))
+
+afterEach(() => {
+  delete document.documentElement.dataset.fullscreen
+  vi.restoreAllMocks()
+  on.mockClear()
+})
+
+it.each(['win32', 'linux'] as const)('subscribes no fullscreen channel on %s', (platform) => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+  syncWindowFullscreen()
+  expect(on).not.toHaveBeenCalled()
+})
+
+it('mirrors the sent fullscreen state onto html[data-fullscreen] on darwin', () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+  syncWindowFullscreen()
+  expect(on).toHaveBeenCalledExactlyOnceWith(DESKTOP_IPC.windowFullscreen, expect.any(Function))
+  const handler = on.mock.calls[0]?.[1] as (event: unknown, fullscreen: boolean) => void
+  handler({}, true)
+  expect(document.documentElement.dataset.fullscreen).toBe('true')
+  handler({}, false)
+  expect(document.documentElement.dataset.fullscreen).toBeUndefined()
+  // A repeated windowed report stays a no-op rather than toggling the flag.
+  handler({}, false)
+  expect(document.documentElement.dataset.fullscreen).toBeUndefined()
+})
diff --git a/apps/desktop/tests/profile-core-cleanup.spec.ts b/apps/desktop/tests/profile-core-cleanup.spec.ts
deleted file mode 100644
index 40f4825571..0000000000
--- a/apps/desktop/tests/profile-core-cleanup.spec.ts
+++ /dev/null
@@ -1,106 +0,0 @@
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, expect, it } from 'vitest'
-import { load } from 'js-yaml'
-import { cleanProfileCorePackages } from '../src/profile-core-cleanup.ts'
-
-const roots: string[] = []
-const core = '@deepseek-ai/dsh-web-app'
-const extra = '@deepseek-ai/optional-plugin'
-
-function fixture(): string {
-  const root = mkdtempSync(join(tmpdir(), 'desktop-core-cleanup-'))
-  roots.push(root)
-  mkdirSync(join(root, 'node_modules', core), { recursive: true })
-  mkdirSync(join(root, 'node_modules', extra), { recursive: true })
-  writeFileSync(join(root, 'package.json'), JSON.stringify({
-    dependencies: { [core]: 'file:./desktop-packages/web.tgz', [extra]: '1.0.0' },
-    optionalDependencies: { [core]: '1.0.0' },
-    pnpm: { overrides: { [core]: '1.0.0', third: '2.0.0' } },
-    dsh: { profile: { bundles: [core, extra] } },
-  }))
-  writeFileSync(join(root, 'pnpm-workspace.yaml'), `nodeLinker: hoisted\noverrides:\n  '${core}': file:./desktop-packages/web.tgz\n  third: 2.0.0\n`)
-  writeFileSync(join(root, 'pnpm-lock.yaml'), 'old resolutions\n')
-  writeFileSync(join(root, 'cordis.patch.yml'), '[]\n')
-  return root
-}
-
-afterEach(() => {
-  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
-})
-
-it('removes core packages and reinstall declarations while preserving optional plugins and configuration', () => {
-  const root = fixture()
-  cleanProfileCorePackages(root, [core], true)
-  expect(existsSync(join(root, 'node_modules', core))).toBe(false)
-  expect(existsSync(join(root, 'node_modules', extra))).toBe(true)
-  expect(JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))).toEqual({
-    dependencies: { [extra]: '1.0.0' }, optionalDependencies: {},
-    pnpm: { overrides: { third: '2.0.0' } }, dsh: { profile: { bundles: [core, extra] } },
-  })
-  expect(load(readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf8'))).toEqual({ nodeLinker: 'hoisted', overrides: { third: '2.0.0' } })
-  expect(readFileSync(join(root, 'cordis.patch.yml'), 'utf8')).toBe('[]\n')
-  expect(existsSync(join(root, 'pnpm-lock.yaml'))).toBe(false)
-  writeFileSync(join(root, 'pnpm-lock.yaml'), 'new plugin resolutions\n')
-  cleanProfileCorePackages(root, [core], true)
-  expect(readFileSync(join(root, 'pnpm-lock.yaml'), 'utf8')).toBe('new plugin resolutions\n')
-})
-
-it('does not clean development profiles', () => {
-  const root = fixture()
-  const before = readFileSync(join(root, 'package.json'), 'utf8')
-  cleanProfileCorePackages(root, [core], false)
-  expect(existsSync(join(root, 'node_modules', core))).toBe(true)
-  expect(readFileSync(join(root, 'package.json'), 'utf8')).toBe(before)
-  expect(existsSync(join(root, 'pnpm-lock.yaml'))).toBe(true)
-})
-
-it('unlinks development fallbacks without deleting their target, including dangling links', () => {
-  const root = fixture()
-  const target = join(root, 'development-package')
-  mkdirSync(target)
-  writeFileSync(join(target, 'sentinel'), 'keep')
-  const owned = join(root, '.dsh-module-fallback', 'node_modules', core)
-  mkdirSync(join(owned, '..'), { recursive: true })
-  symlinkSync(target, owned, 'junction')
-  rmSync(join(root, 'node_modules', core), { recursive: true })
-  symlinkSync(owned, join(root, 'node_modules', core), 'junction')
-  cleanProfileCorePackages(root, [core], true)
-  expect(readFileSync(join(target, 'sentinel'), 'utf8')).toBe('keep')
-  expect(existsSync(owned)).toBe(false)
-  symlinkSync(target, join(root, 'node_modules', core), 'junction')
-  rmSync(target, { recursive: true })
-  cleanProfileCorePackages(root, [core], true)
-  expect(() => lstatSync(join(root, 'node_modules', core))).toThrow()
-})
-
-it('uses the old package inventory to remove retired core names', () => {
-  const root = fixture()
-  const names = ['@deepseek-ai/dsh', '@deepseek-ai/dsh-desktop-host', core].sort()
-  writeFileSync(join(root, 'desktop-packages.json'), JSON.stringify({ schemaVersion: 1, packages: names.map((name, index) => ({
-    name, version: '0.1.2', file: `${index}.tgz`, bytes: 1, integrity: 'sha512-YQ==',
-  })) }))
-  cleanProfileCorePackages(root, [], true)
-  expect(existsSync(join(root, 'node_modules', core))).toBe(false)
-  expect(existsSync(join(root, 'node_modules', extra))).toBe(true)
-})
-
-it('rejects invalid metadata before deleting packages or declarations', () => {
-  const root = fixture()
-  writeFileSync(join(root, 'desktop-packages.json'), '{"schemaVersion":1,"packages":[{"name":"../../outside"}]}')
-  const before = readFileSync(join(root, 'package.json'), 'utf8')
-  expect(() => { cleanProfileCorePackages(root, [core], true) }).toThrow('invalid package record')
-  expect(readFileSync(join(root, 'package.json'), 'utf8')).toBe(before)
-  expect(existsSync(join(root, 'node_modules', core))).toBe(true)
-})
-
-it('refuses redirected package parents without deleting their contents', () => {
-  const root = fixture()
-  const target = join(root, 'external-scope')
-  mkdirSync(join(target, 'dsh-web-app'), { recursive: true })
-  rmSync(join(root, 'node_modules', '@deepseek-ai'), { recursive: true })
-  symlinkSync(target, join(root, 'node_modules', '@deepseek-ai'), 'junction')
-  expect(() => { cleanProfileCorePackages(root, [core], true) }).toThrow('not a real directory')
-  expect(existsSync(join(target, 'dsh-web-app'))).toBe(true)
-})
diff --git a/apps/desktop/tests/profile-packages.spec.ts b/apps/desktop/tests/profile-packages.spec.ts
deleted file mode 100644
index 2233a0128b..0000000000
--- a/apps/desktop/tests/profile-packages.spec.ts
+++ /dev/null
@@ -1,126 +0,0 @@
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, rmdirSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { afterEach, expect, it } from 'vitest'
-import { DESKTOP_PROFILE_STATE, migrateDesktopProfileLinks } from '../src/profile-packages.ts'
-
-const roots: string[] = []
-const symlinks: string[] = []
-
-function fixture() {
-  const root = mkdtempSync(join(tmpdir(), 'desktop-profile-migration-'))
-  roots.push(root)
-  const profile = join(root, 'profile')
-  const target = join(root, 'runtime-package')
-  mkdirSync(join(profile, 'node_modules'), { recursive: true })
-  mkdirSync(target)
-  return { root, profile, target }
-}
-
-function link(target: string, path: string): void {
-  mkdirSync(dirname(path), { recursive: true })
-  symlinkSync(target, path, process.platform === 'win32' ? 'junction' : 'dir')
-  symlinks.push(path)
-}
-
-function writeState(profile: string, links: unknown): void {
-  writeFileSync(join(profile, DESKTOP_PROFILE_STATE), JSON.stringify({
-    schemaVersion: 'obsolete', runtimeId: null, version: 8, lockHash: false, links,
-  }))
-}
-
-afterEach(() => {
-  for (const path of symlinks.splice(0).reverse()) {
-    try {
-      if (lstatSync(path).isSymbolicLink()) unlinkSync(path)
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-    }
-  }
-  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
-})
-
-it('removes recorded links and state without interpreting obsolete runtime fields', () => {
-  const { profile, target } = fixture()
-  const packagePath = join(profile, 'node_modules', '@deepseek-ai/cordis')
-  link(target, packagePath)
-  writeFileSync(join(target, 'package.json'), '{"name":"@deepseek-ai/cordis"}')
-  writeState(profile, [{ name: '@deepseek-ai/cordis', target }])
-  migrateDesktopProfileLinks(profile)
-  expect(existsSync(packagePath)).toBe(false)
-  expect(existsSync(join(profile, DESKTOP_PROFILE_STATE))).toBe(false)
-  expect(readFileSync(join(target, 'package.json'), 'utf8')).toContain('@deepseek-ai/cordis')
-  expect(() => { migrateDesktopProfileLinks(profile) }).not.toThrow()
-})
-
-it('removes an owned broken link without following its target', () => {
-  const { profile, target } = fixture()
-  const packagePath = join(profile, 'node_modules', 'plugin')
-  link(target, packagePath)
-  writeState(profile, [{ name: 'plugin', target }])
-  rmdirSync(target)
-  migrateDesktopProfileLinks(profile)
-  expect(() => lstatSync(packagePath)).toThrow()
-  expect(existsSync(join(profile, DESKTOP_PROFILE_STATE))).toBe(false)
-})
-
-it('preserves a pnpm-installed directory replacing a recorded link', () => {
-  const { profile, target } = fixture()
-  const packagePath = join(profile, 'node_modules', 'plugin')
-  mkdirSync(packagePath)
-  writeFileSync(join(packagePath, 'package.json'), '{"name":"plugin","version":"2.0.0"}')
-  writeState(profile, [{ name: 'plugin', target }])
-  migrateDesktopProfileLinks(profile)
-  expect(readFileSync(join(packagePath, 'package.json'), 'utf8')).toContain('2.0.0')
-  expect(existsSync(join(profile, DESKTOP_PROFILE_STATE))).toBe(false)
-})
-
-it('preserves changed and unrecorded package links', () => {
-  const { root, profile, target } = fixture()
-  const replacement = join(root, 'user-package')
-  mkdirSync(replacement)
-  const changed = join(profile, 'node_modules', 'changed')
-  const unrecorded = join(profile, 'node_modules', 'unrecorded')
-  link(replacement, changed)
-  link(target, unrecorded)
-  const changedTarget = readlinkSync(changed)
-  const unrecordedTarget = readlinkSync(unrecorded)
-  writeState(profile, [{ name: 'changed', target }])
-  migrateDesktopProfileLinks(profile)
-  expect(readlinkSync(changed)).toBe(changedTarget)
-  expect(readlinkSync(unrecorded)).toBe(unrecordedTarget)
-})
-
-it('leaves an uninitialized profile untouched', () => {
-  const { root } = fixture()
-  const missingProfile = join(root, 'absent-profile')
-  migrateDesktopProfileLinks(missingProfile)
-  expect(existsSync(missingProfile)).toBe(false)
-})
-
-it.each(['../../outside', '../outside', '@scope/../../outside', '..\\outside'])('rejects escaping package name %s before removing any links', (name) => {
-  const { root, profile, target } = fixture()
-  const packagePath = join(profile, 'node_modules', 'owned')
-  const outside = join(root, 'outside')
-  link(target, packagePath)
-  link(target, outside)
-  writeState(profile, [{ name: 'owned', target }, { name, target }])
-  expect(() => { migrateDesktopProfileLinks(profile) }).toThrow('invalid legacy package link')
-  expect(lstatSync(packagePath).isSymbolicLink()).toBe(true)
-  expect(lstatSync(outside).isSymbolicLink()).toBe(true)
-  expect(existsSync(join(profile, DESKTOP_PROFILE_STATE))).toBe(true)
-})
-
-it.each(['node_modules', 'node_modules/@scope'])('preserves package links beneath redirected %s', (parent) => {
-  const { root, profile, target } = fixture()
-  const external = join(root, 'external')
-  mkdirSync(external)
-  const packagePath = join(external, 'plugin')
-  link(target, packagePath)
-  if (parent === 'node_modules') rmdirSync(join(profile, 'node_modules'))
-  link(external, join(profile, parent))
-  writeState(profile, [{ name: parent === 'node_modules' ? 'plugin' : '@scope/plugin', target }])
-  migrateDesktopProfileLinks(profile)
-  expect(lstatSync(packagePath).isSymbolicLink()).toBe(true)
-  expect(existsSync(join(profile, DESKTOP_PROFILE_STATE))).toBe(false)
-})
diff --git a/apps/desktop/tests/project-manager.spec.ts b/apps/desktop/tests/project-manager.spec.ts
index f86e3f2f16..1dd76b35f9 100644
--- a/apps/desktop/tests/project-manager.spec.ts
+++ b/apps/desktop/tests/project-manager.spec.ts
@@ -1,6 +1,6 @@
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { resolveDesktopPaths } from '../src/paths.ts'
 import { DesktopProjectManager } from '../src/project-manager.ts'
@@ -43,16 +43,37 @@ afterEach(() => {
 })
 
 describe('desktop external plugin profile', () => {
-  it('cleans application packages only when preparing a production launch', async () => {
+  it('preserves installed packages, profile state, and the lockfile when preparing a launch', async () => {
     const { manager } = setup()
     await manager.applyRelease()
+    seedPlugin(manager)
+    const profile = manager.paths.profile
     const name = '@deepseek-ai/dsh-web-app'
-    const path = join(manager.paths.profile, 'node_modules', name)
+    const path = join(profile, 'node_modules', name)
     mkdirSync(path, { recursive: true })
-    await manager.applyRelease()
-    expect(existsSync(path)).toBe(true)
-    await manager.applyRelease(true)
-    expect(existsSync(path)).toBe(false)
+    writeFileSync(join(path, 'package.json'), JSON.stringify({ name, version: '1.0.0' }))
+    const manifestPath = join(profile, 'package.json')
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as { dependencies: Record<string, string> }
+    manifest.dependencies[name] = '1.0.0'
+    writeFileSync(manifestPath, JSON.stringify(manifest))
+    writeFileSync(join(profile, 'desktop-runtime-state.json'), JSON.stringify({ links: [] }))
+    writeFileSync(join(profile, 'pnpm-lock.yaml'), 'lockfileVersion: 9.0\n')
+    const files = [
+      'package.json',
+      'pnpm-workspace.yaml',
+      'desktop-runtime-state.json',
+      'pnpm-lock.yaml',
+      `node_modules/${name}/package.json`,
+      'node_modules/plugin/package.json',
+      'node_modules/plugin/bundle.yml',
+    ]
+    const before = files.map(file => readFileSync(join(profile, file), 'utf8'))
+
+    await expect(manager.applyRelease()).resolves.toBeUndefined()
+
+    expect(files.map(file => readFileSync(join(profile, file), 'utf8'))).toEqual(before)
+    expect(lstatSync(path).isDirectory()).toBe(true)
+    expect(lstatSync(join(profile, 'node_modules/plugin')).isDirectory()).toBe(true)
   })
   it('reuses plugin files without scanning manifests and can disable them', async () => {
     const { manager } = setup()
@@ -288,3 +309,24 @@ describe.each(['applyRelease', 'disableAllPlugins'] as const)('desktop profile l
     }
   })
 })
+
+describe('desktop link-backend projections', () => {
+  it('removes .dsh-module-fallback projections when preparing a launch', async () => {
+    const { manager } = setup()
+    await manager.applyRelease()
+    const profile = manager.paths.profile
+    const target = join(profile, 'node_modules', 'my-bundle', 'node_modules', 'bridge')
+    mkdirSync(target, { recursive: true })
+    writeFileSync(join(target, 'package.json'), JSON.stringify({ name: 'bridge', version: '1.0.0' }))
+    const owned = join(profile, '.dsh-module-fallback', 'node_modules', 'bridge')
+    mkdirSync(dirname(owned), { recursive: true })
+    symlinkSync(target, owned, process.platform === 'win32' ? 'junction' : 'dir')
+    symlinkSync(owned, join(profile, 'node_modules', 'bridge'), process.platform === 'win32' ? 'junction' : 'dir')
+
+    await manager.applyRelease()
+
+    expect(existsSync(join(profile, '.dsh-module-fallback'))).toBe(false)
+    expect(lstatSync(join(profile, 'node_modules', 'bridge'), { throwIfNoEntry: false })).toBeUndefined()
+    expect(existsSync(join(target, 'package.json'))).toBe(true)
+  })
+})
diff --git a/apps/web/tests/chat-long-interactions.e2e.ts b/apps/web/tests/chat-long-interactions.e2e.ts
index fe8a284967..dec6749ab9 100644
--- a/apps/web/tests/chat-long-interactions.e2e.ts
+++ b/apps/web/tests/chat-long-interactions.e2e.ts
@@ -321,10 +321,10 @@ describe('web e2e: long Chat interaction contract', () => {
     expect(child.session.snapshotEvents().some(event => carries(event, FIXTURE.markers.user(BRANCH_TURN + 1)))).toBe(false)
     expect(child.session.snapshotEvents().some(event => carries(event, FIXTURE.markers.user(FIXTURE.turns)))).toBe(false)
 
+    // The current crumb renders as plain text, not a button.
     const currentCrumb = page.getByRole('navigation', { name: 'Session hierarchy' })
-      .getByRole('button').last()
-    await expect.poll(() => currentCrumb.textContent(), { timeout: 15_000 })
-      .toBe(`${FIXTURE.title} (1)`)
+      .getByText(`${FIXTURE.title} (1)`, { exact: true })
+    await expect.poll(() => currentCrumb.count(), { timeout: 15_000 }).toBe(1)
     await page.getByText(branchAssistantMarker, { exact: false }).last().waitFor({ timeout: 15_000 })
     const settled = scaffold.whenTurnSettled(60_000)
     const composer = page.locator('[data-composer-input][contenteditable="true"]').last()
diff --git a/apps/web/tests/details-session-lifecycle.e2e.ts b/apps/web/tests/details-session-lifecycle.e2e.ts
index 0f807e3b91..924105c184 100644
--- a/apps/web/tests/details-session-lifecycle.e2e.ts
+++ b/apps/web/tests/details-session-lifecycle.e2e.ts
@@ -84,6 +84,10 @@ async function paneSnapshot(page: Page) {
 
 /** Product-visible geometry, pane state, and expanded Files directories at a settled checkpoint. */
 async function sidebarSnapshot(page: Page) {
+  // A toggle holds data-animating until transitionend or its 600ms fallback
+  // (ui-layout AppFrame); computed transition values are stable only after it
+  // drops, so capturing earlier races the settle window.
+  await expect.poll(() => appFrame(page).evaluate(frame => frame.hasAttribute('data-animating'))).toBe(false)
   const geometry = await appFrame(page).evaluate((frame) => {
     const panel = frame.querySelector<HTMLElement>('[data-sidebar-right-panel]')
     if (panel === null) throw new Error('Sidebar panel is not mounted')
diff --git a/apps/web/tests/expected/agent-preset-selection/header.expected.md b/apps/web/tests/expected/agent-preset-selection/header.expected.md
index c6b9f141bf..32b0ea6a2a 100644
--- a/apps/web/tests/expected/agent-preset-selection/header.expected.md
+++ b/apps/web/tests/expected/agent-preset-selection/header.expected.md
@@ -1,6 +1,5 @@
 - navigation "Session hierarchy":
-  - button "Seeded turn" [disabled]
-  - text: /
+  - text: Seeded turn /
   - button "1 subagent"
 - text: Minimal mode
 - button "More actions"
diff --git a/apps/web/tests/expected/clickable-links-gallery/ui.expected.md b/apps/web/tests/expected/clickable-links-gallery/ui.expected.md
index 67f77b8b26..43b462deac 100644
--- a/apps/web/tests/expected/clickable-links-gallery/ui.expected.md
+++ b/apps/web/tests/expected/clickable-links-gallery/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Clickable links gallery" [disabled]
+  - navigation "Session hierarchy": Clickable links gallery
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/cordis-history/ui.expected.md b/apps/web/tests/expected/cordis-history/ui.expected.md
index 2327e6714a..2ddd03bddb 100644
--- a/apps/web/tests/expected/cordis-history/ui.expected.md
+++ b/apps/web/tests/expected/cordis-history/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use only Cordis tools. First" [disabled]
+  - navigation "Session hierarchy": Use only Cordis tools. First
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/github-ready-review/conversation-expanded.expected.md b/apps/web/tests/expected/github-ready-review/conversation-expanded.expected.md
index 3b072f4054..4abbc3d013 100644
--- a/apps/web/tests/expected/github-ready-review/conversation-expanded.expected.md
+++ b/apps/web/tests/expected/github-ready-review/conversation-expanded.expected.md
@@ -9,8 +9,7 @@
 ---
 
 - banner:
-  - navigation "Session hierarchy":
-    - button "Review deepseek-ai/deepseek-harness#314" [disabled]
+  - navigation "Session hierarchy": Review deepseek-ai/deepseek-harness#314
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/github-ready-review/conversation.expected.md b/apps/web/tests/expected/github-ready-review/conversation.expected.md
index 87b48ef41c..7c18886de2 100644
--- a/apps/web/tests/expected/github-ready-review/conversation.expected.md
+++ b/apps/web/tests/expected/github-ready-review/conversation.expected.md
@@ -9,8 +9,7 @@
 ---
 
 - banner:
-  - navigation "Session hierarchy":
-    - button "Review deepseek-ai/deepseek-harness#314" [disabled]
+  - navigation "Session hierarchy": Review deepseek-ai/deepseek-harness#314
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/goal-command-presentation/ui.expected.md b/apps/web/tests/expected/goal-command-presentation/ui.expected.md
index dd44da4896..2a18e51ec1 100644
--- a/apps/web/tests/expected/goal-command-presentation/ui.expected.md
+++ b/apps/web/tests/expected/goal-command-presentation/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "workspace" [disabled]
+  - navigation "Session hierarchy": workspace
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/markdown-cjk-strong/ui.expected.md b/apps/web/tests/expected/markdown-cjk-strong/ui.expected.md
index c8f054e060..fde16c8905 100644
--- a/apps/web/tests/expected/markdown-cjk-strong/ui.expected.md
+++ b/apps/web/tests/expected/markdown-cjk-strong/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "CJK strong emphasis" [disabled]
+  - navigation "Session hierarchy": CJK strong emphasis
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/markdown-images/ui.expected.md b/apps/web/tests/expected/markdown-images/ui.expected.md
index be7317eb3e..89743e8a28 100644
--- a/apps/web/tests/expected/markdown-images/ui.expected.md
+++ b/apps/web/tests/expected/markdown-images/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Markdown image policy" [disabled]
+  - navigation "Session hierarchy": Markdown image policy
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/markdown-inline-code-links/ui.expected.md b/apps/web/tests/expected/markdown-inline-code-links/ui.expected.md
index c637b199dd..1704621f59 100644
--- a/apps/web/tests/expected/markdown-inline-code-links/ui.expected.md
+++ b/apps/web/tests/expected/markdown-inline-code-links/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Inline code links" [disabled]
+  - navigation "Session hierarchy": Inline code links
   - button "More actions"
   - tablist:
     - tab "Chat" [selected]
diff --git a/apps/web/tests/expected/math-rendering/ui.expected.md b/apps/web/tests/expected/math-rendering/ui.expected.md
index faab58a5b2..a0ef96a2e1 100644
--- a/apps/web/tests/expected/math-rendering/ui.expected.md
+++ b/apps/web/tests/expected/math-rendering/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Math rendering" [disabled]
+  - navigation "Session hierarchy": Math rendering
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/reference-composer/order.expected.md b/apps/web/tests/expected/reference-composer/order.expected.md
index ac92c645bf..816a44d793 100644
--- a/apps/web/tests/expected/reference-composer/order.expected.md
+++ b/apps/web/tests/expected/reference-composer/order.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reference order target" [disabled]
+  - navigation "Session hierarchy": Reference order target
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/skill-user-invoke/ui-expanded.expected.md b/apps/web/tests/expected/skill-user-invoke/ui-expanded.expected.md
index 415692d90c..1876f63c32 100644
--- a/apps/web/tests/expected/skill-user-invoke/ui-expanded.expected.md
+++ b/apps/web/tests/expected/skill-user-invoke/ui-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "/user-invoke-demo @\"meeting notes.md\" an" [disabled]
+  - navigation "Session hierarchy": /user-invoke-demo @"meeting notes.md" an
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/skill-user-invoke/ui.expected.md b/apps/web/tests/expected/skill-user-invoke/ui.expected.md
index dc6265c650..b66832d25e 100644
--- a/apps/web/tests/expected/skill-user-invoke/ui.expected.md
+++ b/apps/web/tests/expected/skill-user-invoke/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "/user-invoke-demo @\"meeting notes.md\" an" [disabled]
+  - navigation "Session hierarchy": /user-invoke-demo @"meeting notes.md" an
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/stats-paged-history/ui.expected.md b/apps/web/tests/expected/stats-paged-history/ui.expected.md
index 579e3689d4..2ac8c3a571 100644
--- a/apps/web/tests/expected/stats-paged-history/ui.expected.md
+++ b/apps/web/tests/expected/stats-paged-history/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "{{workspace}}" [disabled]
+  - navigation "Session hierarchy": {{workspace}}
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/apps/web/tests/expected/steer-all/mid-steer.expected.md b/apps/web/tests/expected/steer-all/mid-steer.expected.md
index 253d2d65bf..f3e9564660 100644
--- a/apps/web/tests/expected/steer-all/mid-steer.expected.md
+++ b/apps/web/tests/expected/steer-all/mid-steer.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/steer-all/settled-expanded.expected.md b/apps/web/tests/expected/steer-all/settled-expanded.expected.md
index 5d78fdf78c..9538b35054 100644
--- a/apps/web/tests/expected/steer-all/settled-expanded.expected.md
+++ b/apps/web/tests/expected/steer-all/settled-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/expected/steer-all/settled.expected.md b/apps/web/tests/expected/steer-all/settled.expected.md
index 28daa440d7..870a712c04 100644
--- a/apps/web/tests/expected/steer-all/settled.expected.md
+++ b/apps/web/tests/expected/steer-all/settled.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/plugin-manager.e2e.ts b/apps/web/tests/plugin-manager.e2e.ts
index ca65a097d0..f2146bc906 100644
--- a/apps/web/tests/plugin-manager.e2e.ts
+++ b/apps/web/tests/plugin-manager.e2e.ts
@@ -174,7 +174,9 @@ describe('web e2e: plugin manager', () => {
       }), { surfaceOp: 'append' })
       agent.session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
       await scaffold.ctx.sessions.flush(agent.session)
-      await teamPage.getByRole('button', { name: 'Team UI lifecycle', exact: true }).waitFor()
+      // The current crumb renders as plain text inside the zh-labeled hierarchy nav.
+      await teamPage.getByRole('navigation', { name: '会话层级' })
+        .getByText('Team UI lifecycle', { exact: true }).waitFor()
       const action = teamPage.locator('[data-team-action]')
       expect(await action.count()).toBe(0)
       await toggle.click()
diff --git a/apps/web/tests/scaffold.ts b/apps/web/tests/scaffold.ts
index 20d3473e69..e7249a0b67 100644
--- a/apps/web/tests/scaffold.ts
+++ b/apps/web/tests/scaffold.ts
@@ -57,7 +57,7 @@ import {
   writesCurrentSessionFixtures,
   type NormalizeContext,
 } from '@deepseek-ai/dsh-session-snapshot'
-import type { Profile, ProfileContext, ProfileResolutionMode } from '@deepseek-ai/dsh-app-boot'
+import type { Profile, ProfileContext } from '@deepseek-ai/dsh-app-boot'
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths'
 import { LlmAdapter } from '@deepseek-ai/dsh-llm'
 import type {
@@ -196,7 +196,7 @@ export function recordedSessionFixturePath(path: string, version: number): strin
 /** The shipped composition under test: the dsh-base and dsh-web-app bundle patches over the empty profile root. */
 const BASE_PATCH_PATH = join(REPO_ROOT, 'packages/bundle/base/cordis.patch.yml')
 const WEB_PATCH_PATH = join(REPO_ROOT, 'packages/bundle/web-app/cordis.patch.yml')
-/** The installation anchor whose dependency surface the profile module fallback mirrors. */
+/** The installation anchor whose dependency surface the runtime resolution mirrors. */
 const INSTALL_ANCHOR = join(REPO_ROOT, 'apps/cli/package.json')
 
 // Replay publishes the provider catalog the gateway routes to (providers
@@ -304,8 +304,6 @@ export interface WebScaffold {
 export interface LaunchOptions {
   /** The scaffold enables developer tools unless false preserves the shipped default. */
   developerTools?: boolean
-  /** Profile resolver backend used by this test Host; defaults to runtime coverage. */
-  profileResolutionMode?: Extract<ProfileResolutionMode, 'dual' | 'runtime'>
   /** Enable the real Open In rows with deterministic launch-environment facts. */
   openInAppEnvironment?: LaunchEnvironmentSnapshot
   /** Compare the replayed root session with `replayFixture`; defaults on for a manifest-owned canonical recording. */
@@ -467,7 +465,7 @@ async function cleanupScaffoldWorld(ctx: Context, workspaceCwd: string, persiste
 export async function launchWebScaffold(options: LaunchOptions = {}): Promise<WebScaffold> {
   requireDist()
   const {
-    auditStartupEntries, composeEntries, createProfileResolutionGeneration, healProfilesModuleFallback, initProfile,
+    auditStartupEntries, composeEntries, createRuntimeResolution, initProfile,
     mountRootInclude, readProfileManifest, readProfilePatches, loadProfileDirectory, loadOverlayPatches, PluginPackages,
   } = appBoot()
   const mode = webSnapshotMode()
@@ -750,11 +748,8 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
       patchPath: join(profileDir, 'cordis.patch.yml'),
       patches: [],
     }
-    const profileResolutionMode = options.profileResolutionMode ?? 'runtime'
     const resolutionOptions = { installAnchor: INSTALL_ANCHOR, home: harnessHome, profile }
-    const resolution = profileResolutionMode === 'runtime'
-      ? await createProfileResolutionGeneration(resolutionOptions)
-      : await healProfilesModuleFallback(resolutionOptions)
+    const resolution = await createRuntimeResolution(resolutionOptions)
     await mkdir(profileDir, { recursive: true })
     const rootConfig = join(profileDir, 'cordis.yml')
     await writeFile(rootConfig, '[]\n')
@@ -801,8 +796,7 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
       },
     })
     await ctx.plugin(PluginPackages, {
-      generation: resolution,
-      behavior: profileResolutionMode === 'dual' ? 'verify' : 'enforce',
+      resolution,
     })
     await ctx.plugin(Loader)
     if (profileContext === undefined) {
@@ -819,7 +813,7 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
     } else {
       // The launcher's own mount, so the manager's reloads find the root Include
       // and compose the same layers the profile files name; bare names still
-      // resolve through the resolution generation above, as in the direct mount.
+      // resolve through the runtime resolution above, as in the direct mount.
       await mountRootInclude(ctx, rootConfig, readProfilePatches('dsh', profileContext))
     }
     await ctx.loader.await()
diff --git a/apps/web/tests/schedule-after.e2e.ts b/apps/web/tests/schedule-after.e2e.ts
index dfa6d6e491..fd2a0369fa 100644
--- a/apps/web/tests/schedule-after.e2e.ts
+++ b/apps/web/tests/schedule-after.e2e.ts
@@ -249,8 +249,9 @@ async function openSession(page: Page, title: string): Promise<void> {
   const row = page.getByRole('treeitem', { name: new RegExp(title) })
   await row.waitFor({ timeout: 15_000 })
   await row.click()
+  // The current crumb renders as plain text, not a button.
   await page.getByRole('navigation', { name: 'Session hierarchy' })
-    .getByRole('button', { name: title, exact: true })
+    .getByText(title, { exact: true })
     .waitFor({ timeout: 15_000 })
 }
 
diff --git a/apps/web/tests/sessionless-header.e2e.ts b/apps/web/tests/sessionless-header.e2e.ts
index 36547842b7..b2c1a85fb0 100644
--- a/apps/web/tests/sessionless-header.e2e.ts
+++ b/apps/web/tests/sessionless-header.e2e.ts
@@ -37,13 +37,13 @@ describe('navigation without a selected Session', () => {
       expect(await header.evaluate(element => element.getBoundingClientRect().height)).toBe(platform === 'darwin' ? 40 : 0)
       await page.getByRole('button', { name: 'Collapse sidebar', exact: true }).click()
       const reopen = platform === 'darwin'
-        ? page.locator('[data-conversation-header-leading]').getByRole('button', { name: 'Open sidebar', exact: true })
+        ? page.locator('[data-shell-leading]').getByRole('button', { name: 'Open sidebar', exact: true })
         : page.getByRole('button', { name: 'Open sidebar', exact: true })
       await reopen.waitFor({ state: 'visible' })
       expect(await sessionHeader.count()).toBe(0)
       expect(await header.evaluate(element => element.getBoundingClientRect().height)).toBe(platform === 'darwin' ? 40 : 0)
       if (platform === 'darwin') {
-        expect(await page.locator('[data-conversation-header-leading]').getByRole('button', { name: 'New session', exact: true }).isVisible()).toBe(true)
+        expect(await page.locator('[data-shell-leading]').getByRole('button', { name: 'New session', exact: true }).isVisible()).toBe(true)
       }
       // The open label precedes both the column slide and the rail's mount animation.
       // Reverse the pointer action only after the rendered sidebar has settled.
diff --git a/apps/web/tests/shipped-composition.e2e.ts b/apps/web/tests/shipped-composition.e2e.ts
index 65a33bee1c..a6656d2ff5 100644
--- a/apps/web/tests/shipped-composition.e2e.ts
+++ b/apps/web/tests/shipped-composition.e2e.ts
@@ -2,7 +2,7 @@
 // and asserts its catalog, defaults, Loader lifecycle, and one complete Auto
 // producer-to-tool path. Browser scenarios in this lane own visual behavior.
 import { randomUUID } from 'node:crypto'
-import { existsSync, readFileSync } from 'node:fs'
+import { readFileSync } from 'node:fs'
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -522,7 +522,6 @@ afterEach(async () => {
 
 it('assembles the shipped Web transport, catalog, guidance, and defaults', async () => {
   scaffold = await launchWebScaffold({ deepSeekMissingCredential: true })
-  expect(existsSync(join(scaffold.harnessHome, 'profiles', 'node_modules'))).toBe(false)
   const ctx = scaffold.ctx
   expect(ctx.llm.listProviders().some(provider => provider.id === 'deepseek-messages')).toBe(false)
   expect(ctx.agentDefaultModel.currentSelection()).toEqual({ provider: 'deepseek-official', model: 'deepseek-flash' })
@@ -650,9 +649,8 @@ it('assembles the shipped Web transport, catalog, guidance, and defaults', async
   }
 }, 120_000)
 
-it('ships PTC with run_code but without the general workflow SDK binding under dual resolution', async () => {
-  scaffold = await launchWebScaffold({ deepSeekMissingCredential: true, profileResolutionMode: 'dual' })
-  expect(existsSync(join(scaffold.harnessHome, 'profiles', 'node_modules'))).toBe(true)
+it('ships PTC with run_code but without the general workflow SDK binding', async () => {
+  scaffold = await launchWebScaffold({ deepSeekMissingCredential: true })
   const ctx = scaffold.ctx
   const handle = await ctx.agents.create({
     sessionId: SessionId('shipped-ptc-composition'),
diff --git a/apps/web/tests/snapshots/streaming-fence-highlight/mid-stream.expected.md b/apps/web/tests/snapshots/streaming-fence-highlight/mid-stream.expected.md
index 210bc22511..27e4c283ae 100644
--- a/apps/web/tests/snapshots/streaming-fence-highlight/mid-stream.expected.md
+++ b/apps/web/tests/snapshots/streaming-fence-highlight/mid-stream.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Stream one TypeScript fence for" [disabled]
+  - navigation "Session hierarchy": Stream one TypeScript fence for
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/apps/web/tests/subagent-conversation.e2e.ts b/apps/web/tests/subagent-conversation.e2e.ts
index f6fdb33ecd..3fc4841f43 100644
--- a/apps/web/tests/subagent-conversation.e2e.ts
+++ b/apps/web/tests/subagent-conversation.e2e.ts
@@ -598,7 +598,9 @@ describe('web e2e: persisted subagent conversation and human continuation', () =
     expect(await page.getByRole('tree', { name: 'Sessions' })
       .getByRole('treeitem', { name: 'Ungrouped', exact: true }).count()).toBe(0)
     const hierarchy = page.getByRole('navigation', { name: 'Session hierarchy' })
-    await expect.poll(() => hierarchy.getByRole('button').count()).toBe(1)
+    // The current crumb is plain text; the fork sits at the root, so no ancestor crumb buttons remain.
+    await expect.poll(() => hierarchy.getByText(`${CHILD_TITLE} (1)`, { exact: true }).count()).toBe(1)
+    expect(await hierarchy.getByRole('button').count()).toBe(0)
     await compareOrRefreshGolden(
       FORK_EXPECTED,
       await captureStableAria(page, '[role="tree"][aria-label="Sessions"]', scaffold.workspaceCwd),
diff --git a/docs/subsystems/slots.i18n.yaml b/docs/subsystems/slots.i18n.yaml
index 485e7af213..cd5d7d24e1 100644
--- a/docs/subsystems/slots.i18n.yaml
+++ b/docs/subsystems/slots.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/slots.md
-slots.md: 1b7dbd9e8ce81d298094df8a2adf7da39178541d
-slots.zh.md: b852e3f204c0acea49f94cffcedf2eebad0e432e
+slots.md: c441557092d0273c7beebd222ed7ca329b02c0df
+slots.zh.md: 48aafad0042e06f7a6945be4768249dfa4b5aab1
diff --git a/docs/subsystems/slots.md b/docs/subsystems/slots.md
index 1b7dbd9e8c..c441557092 100644
--- a/docs/subsystems/slots.md
+++ b/docs/subsystems/slots.md
@@ -175,6 +175,7 @@ root
 │     │  └─ sidebar.right.tab.guide.entry
 │     ├─ sidebar.right.pane.tab.title
 │     └─ sidebar.right.tab.menu.item
+├─ shell.leading
 └─ shell.overlay
 ```
 
diff --git a/docs/subsystems/slots.zh.md b/docs/subsystems/slots.zh.md
index b852e3f204..48aafad004 100644
--- a/docs/subsystems/slots.zh.md
+++ b/docs/subsystems/slots.zh.md
@@ -175,6 +175,7 @@ root
 │     │  └─ sidebar.right.tab.guide.entry
 │     ├─ sidebar.right.pane.tab.title
 │     └─ sidebar.right.tab.menu.item
+├─ shell.leading
 └─ shell.overlay
 ```
 
diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml
index 208335da8e..8a41d074ff 100644
--- a/packages/boot/app-boot/README.i18n.yaml
+++ b/packages/boot/app-boot/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md
-README.md: 9d9b98ad4669931c32886a73937f4c33ab746b74
-README.zh.md: f7b092ad2f52f51404b02177059e8e4b0121b7c3
+README.md: fed6f6833dd22254270b86beccd797d3b6054d7f
+README.zh.md: bedf8ae3d019607cbf04e24a38febd3441e06bbd
diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md
index 9d9b98ad46..fed6f6833d 100644
--- a/packages/boot/app-boot/README.md
+++ b/packages/boot/app-boot/README.md
@@ -58,7 +58,7 @@ The enabled `dsh-hmr` plugin watches the profile manifest and both user patch fi
 
 Inserted plugin names may be absolute filesystem paths, file URLs, or package specifiers. Patch loading converts absolute paths and patch-relative `./` or `../` paths to file URLs within `insert` rows and their nested groups; existing-entry name assertions and replacement `config` values remain literal.
 
-Before mounting profile rows, the `dsh` launcher computes one immutable package-resolution generation from the installation and ordered bundle dependency graphs. Runtime mode is the default: it installs the generation through Node's ESM and CommonJS resolvers without creating fallback links. Plain Node callers of `runProfile` may explicitly select link mode to materialize the generation, dual mode to materialize and verify it, or runtime mode. Packaged executables and the Electron Host always use runtime mode.
+Before mounting profile rows, the `dsh` launcher computes one immutable runtime resolution from the installation and ordered bundle dependency graphs. Every profile launcher uses runtime resolution, including plain Node, packaged executables, and the Electron Host. It installs the runtime resolution through Node's ESM and CommonJS resolvers without creating fallback links.
 
 `sanitizeProfile(binName, profileDir, bundles)` provides filesystem recovery without loading plugins or parsing patches. Desktop uses it for native fatal recovery. Call it only after stopping the profile and excluding concurrent profile writes. It renames the profile’s `cordis.patch.yml` to a unique `.bak-<timestamp>` sibling and restores the supplied bundle list, preserving installed packages and other manifest fields. The timestamp is Unix time in milliseconds; collisions append an ordinal (`-1`, `-2`, …) without changing it. It returns the backup path, or `undefined` when no patch exists; missing profiles remain absent. Profile initialization recreates an empty patch on the next launch. The home-level patch is unchanged. Invalid profile JSON fails before mutation; later errors propagate and retain completed changes for retry.
 
@@ -110,12 +110,12 @@ This section explains how the outcomes above are realized and points at the code
 ### Design notes
 
 - **Profile launch data.** `ctx.profileContext` contains only profile locations, startup bundle names, parsed invocation overlays and the telemetry opt-out value. `readProfilePatches()` composes the supplied startup profile or reads current files at those locations; callers schedule and apply the result.
-- **Process-local module resolution.** Runtime and dual modes install one generation on Node's internal ESM and CommonJS resolvers before profile rows mount; link mode leaves both resolvers unchanged. Node still owns exports, conditions, subpaths, module caches, and error codes; routed ESM failures report the original importer instead of the internal lookup anchor. `ctx.pluginPackages` exposes package metadata from the same generation without recording Entry imports; an installed generation is authoritative even for a miss, while low-level embedders that install the service without one retain native lookup.
+- **Process-local module resolution.** The launcher installs the runtime resolution as an interception on Node's internal ESM and CommonJS resolvers before profile rows mount. Node still owns exports, conditions, subpaths, module caches, and error codes; routed ESM failures report the original importer instead of the internal lookup anchor. `ctx.pluginPackages` exposes package metadata from the same runtime resolution without recording Entry imports; an installed runtime resolution is authoritative even for a miss, while low-level embedders that install the service without one retain native lookup.
 - **Two Loader builtins.** `mountRootInclude` registers `cordis:include` and `cordis:group` as Loader builtins: a group row gives one `isolate` realm to a provider and its consumers together, and an agent preset outside this workspace cannot resolve `@deepseek-ai/cordis-plugin-group` by name. Both load through the ambient module pipeline rather than the included tree's own specifier resolution.
-- **Consumer-owned strictness.** Ordinary Loader groups keep successful siblings. App-boot applies the global required-entry policy after initial settlement; agent presets and dynamic multi-entry compositions own and dispose their separate generation when they require all-or-nothing setup. App-boot reads failed fibers to report their recorded errors and coalesces duplicate Loader rejection notifications through one process checkpoint.
-- **One fallback generation.** The installation-first and ordered-bundle breadth-first traversal produces both the runtime table and the retained disk materializer. Runtime mode creates no resolution links and ignores stale projections at their former lookup positions. External bare targets selected by package `imports` use the same package order, while Node retains mapping, conditions, and exact target resolution. Link mode materializes the same table; dual mode also compares Node's disk result with the table. A complete successor may add package names atomically, while changing or removing an existing mapping requires restart.
-- **Application-owned profiles.** Link mode projects missing installation and bundle packages inside the profile without writing a shared Harness-home fallback. Runtime mode supplies the same installation and bundle generation without creating links. Package operations remove only profile links owned by dsh; pnpm-managed entries remain untouched.
-- **Owned Workers.** Worker build banners import `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` before bundled business code. Each Worker installs the structured-cloned generation in its own isolate. The bootstrap bundle has no static package imports. Source Worker entries retain their self-contained dependency closure, and third-party Workers receive no injection.
+- **Consumer-owned strictness.** Ordinary Loader groups keep successful siblings. App-boot applies the global required-entry policy after initial settlement; agent presets and dynamic multi-entry compositions own and dispose their separate Loader subtree when they require all-or-nothing setup. App-boot reads failed fibers to report their recorded errors and coalesces duplicate Loader rejection notifications through one process checkpoint.
+- **One runtime resolution.** The installation-first and ordered-bundle breadth-first traversal produces the runtime table. Runtime resolution creates no links; runtime resolution entries occupy their package names at `$DSH_HOME/profiles/node_modules`, and every other name sees that directory as an ordinary ancestor. Profile load removes the `.dsh-module-fallback` projections that link-backend releases wrote into a profile; pnpm-installed packages stay. External bare targets selected by package `imports` use the same package order, while Node retains mapping, conditions, and exact target resolution. A complete successor may add package names atomically, while changing or removing an existing mapping requires restart.
+- **Application-owned profiles.** Application-owned profiles use the same runtime resolution. Resolution does not modify their `node_modules`; pnpm owns installed packages.
+- **Owned Workers.** Worker build banners import `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` before bundled business code. Each Worker installs the structured-cloned runtime resolution in its own isolate. The bootstrap bundle has no static package imports. Source Worker entries retain their self-contained dependency closure, and third-party Workers receive no injection.
 - **Update completion.** App boot observes restart failures through the `internal/update` waterfall. Live patch reloads wait for the tree's fibers before auditing activation; `Fiber.update()` and `Entry.update()` alone do not establish restart success.
 - **One rejection checkpoint.** `inactiveEntries` keeps the exact reasons it folds into the boot diagnostic visible through the next process rejection checkpoint, so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal.
 - **Two-stage failure labels.** Outside startup audit failures, `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`, and appends the deepest plugin error's stack. Plugin diagnostics retain nested causes and aggregate member failures; cyclic causes stop traversal without replacing the original error.
@@ -131,11 +131,11 @@ The exports each own one stage of the boot: config resolution and snapshot repla
 | File | Role |
 |---|---|
 | [`src/index.ts`](src/index.ts) | Boot helpers: config resolution, environment loading, fail-loud guard, activation audit, patch parsing, config dump, harness-source section |
-| [`src/profile.ts`](src/profile.ts) | Profile discovery, initialization, bundle resolution, module fallback |
+| [`src/profile.ts`](src/profile.ts) | Profile discovery, initialization, bundle resolution, runtime resolution construction |
 | [`src/profile-plugins.ts`](src/profile-plugins.ts) | Installed dependencies, bundle activation policy, and manifest updates |
 | [`src/profile-sanitize.ts`](src/profile-sanitize.ts) | Profile patch backup and recovery bundle activation |
 | [`src/profile-resolution/`](src/profile-resolution/) | Runtime resolver, package-metadata service, and built Worker bootstrap |
-| — | No runtime invariant companion is published; one registration owns each resolver generation, and dual mode compares the independently materialized result at resolution time. |
+| — | No runtime invariant companion is published; one interception owns each runtime resolution. |
 
 </details>
 
@@ -173,7 +173,7 @@ Boot itself changes no request prefix. `addHarnessSourceSection` places its sour
 
 These limits describe when this boot library is a poor fit or needs special care. They are current package constraints, not a task backlog.
 
-- **Runtime resolution depends on Node internals** — supported Node versions require the native builtin-access addon and executable compatibility coverage. Only built Harness-owned Workers receive the generation bootstrap; third-party Workers and custom `vm` linkers keep native resolution.
+- **Runtime resolution depends on Node internals** — supported Node versions require the native builtin-access addon and executable compatibility coverage. Only built Harness-owned Workers receive the runtime resolution bootstrap; third-party Workers and custom `vm` linkers keep native resolution.
 - **Snapshot replay swapping is basename-specific** — only a config ending in `cordis.yml` or `cordis.yaml` maps to the sibling `cordis.snapshot.yml`; custom config names require caller-managed selection.
 - **Environment discovery is launch-scoped** — `loadLayeredEnv` reads only the invocation directory and Harness home once; it does not search parents or follow a workspace selected later. `loadEnv` remains the one-directory helper for non-product bins.
 - **A user patch replaces the whole matched config** — an id-targeted patch does not deep-merge, so a profile override restates the bundle fields it keeps.
diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md
index f7b092ad2f..bedf8ae3d0 100644
--- a/packages/boot/app-boot/README.zh.md
+++ b/packages/boot/app-boot/README.zh.md
@@ -58,7 +58,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head
 
 插入条目的插件名可以是绝对文件系统路径、文件 URL 或包标识符。patch 加载会把 `insert` 条目及其嵌套分组中的绝对路径以及相对于 patch 文件的 `./` 或 `../` 路径转换为文件 URL；对已有条目名称的断言及替换用的 `config` 值保持原样。
 
-挂载 profile 条目前，`dsh` launcher 会从安装依赖图与有序 bundle 依赖图计算一份不可变的 package resolution generation。默认使用 runtime 模式，将 generation 安装到 Node 的 ESM 与 CommonJS 解析器中，不创建 fallback 链接。普通 Node 中的 `runProfile` 调用方可以显式选择 link 模式以物化 generation，选择 dual 模式以物化并校验它，或选择 runtime 模式。打包可执行文件和 Electron Host 始终使用 runtime 模式。
+挂载 profile 条目前，`dsh` launcher 会从安装依赖图与有序 bundle 依赖图计算一份不可变的 runtime resolution。普通 Node、打包可执行文件与 Electron Host 等所有 profile 启动器都使用 runtime 解析，将 runtime resolution 安装到 Node 的 ESM 与 CommonJS 解析器中，不创建 fallback 链接。
 
 `sanitizeProfile(binName, profileDir, bundles)` 提供文件恢复，无需加载插件或解析 patch。Desktop 在原生致命错误恢复中调用它。调用前必须停止 profile 并排除并发 profile 写入。它将 profile 的 `cordis.patch.yml` 重命名为带唯一 `.bak-<timestamp>` 后缀的同目录备份，并恢复调用方指定的 bundle 列表，保留已安装包和其他 manifest 字段。时间戳为 Unix 毫秒数；同名备份已存在时追加序号（`-1`、`-2`、……），时间戳保持不变。返回值为备份路径；patch 不存在时返回 `undefined`，缺失的 profile 不会被创建。下次启动的 profile 初始化会重新创建空 patch。home 级 patch 不变。无效 profile JSON 在修改前报错；后续错误向调用方抛出，保留已完成的修改供重试。
 
@@ -110,12 +110,12 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 ### 设计说明
 
 - **Profile 启动数据。** `ctx.profileContext` 只包含 profile 位置、启动时组合包名称、已解析的调用级 overlay 与遥测退出值。`readProfilePatches()` 组合传入的启动 profile，或读取这些位置上的当前文件；调用方负责调度和应用结果。
-- **进程内模块解析。** runtime 和 dual 模式会在挂载 profile 条目前，将一份 generation 安装到 Node 的 ESM 与 CommonJS 内部 resolver；link 模式不修改这两个 resolver。exports、conditions、subpath、模块缓存和错误码仍由 Node 负责；路由后的 ESM 失败会报告原始 importer，而不是内部查找锚点。`ctx.pluginPackages` 从同一 generation 提供 package metadata，不记录 Entry import；安装 generation 后，即使查询未命中也以 generation 为准，仅安装服务而未提供 generation 的底层嵌入方仍使用 Node 原生查找。
+- **进程内模块解析。** runtime 解析会在挂载 profile 条目前，将 runtime resolution 作为拦截安装到 Node 的 ESM 与 CommonJS 内部 resolver。exports、conditions、subpath、模块缓存和错误码仍由 Node 负责；路由后的 ESM 失败会报告原始 importer，而不是内部查找锚点。`ctx.pluginPackages` 从同一 runtime resolution 提供 package metadata，不记录 Entry import；安装 runtime resolution 后，即使查询未命中也以 runtime resolution 为准，仅安装服务而未提供 runtime resolution 的底层嵌入方仍使用 Node 原生查找。
 - **两个 Loader builtin。** `mountRootInclude` 把 `cordis:include` 与 `cordis:group` 注册为 Loader builtin：group 行能把一个提供方与它的消费方放进同一个 `isolate` realm，而位于本工作区之外的 agent preset 无法按名称解析 `@deepseek-ai/cordis-plugin-group`。两者都通过宿主的模块管线加载，而非被包含树自身的说明符解析。
-- **由 consumer 持有严格语义。** 普通 Loader group 保留成功 sibling。App-boot 在首次结算后应用全局 required-entry policy；agent preset 与动态多 entry 组合在需要 all-or-nothing setup 时，持有并拆卸各自的独立 generation。App-boot 读取 failed fiber 来报告已记录的错误，并在一个进程检查点内合并 Loader 重复的 rejection 通知。
-- **唯一 fallback generation。** 安装优先、有序 bundle 逐根 breadth-first 遍历同时生成运行时表和保留的磁盘 materializer。runtime 模式不创建解析链接，并在旧链接原来的查找位置忽略陈旧投影。package `imports` 选中的外部 bare target 使用相同的选包顺序，映射、conditions 和精确 target 解析仍由 Node 负责。link 模式物化同一张表；dual 模式还会比较 Node 的磁盘结果与表。完整后继 generation 可以原子增加 package name，修改或删除既有映射则要求重启。
-- **应用自有 profile。** link 模式在 profile 内投影缺失的安装包及 bundle 包，不写共享的 Harness-home 后备目录。runtime 模式提供相同的安装包及 bundle generation，不创建链接。包操作仅移除 dsh 所有的 profile 链接；pnpm 管理的条目保持不变。
-- **自有 Worker。** Worker 构建 banner 会在业务 bundle 前导入 `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap`。每个 Worker 在自己的 isolate 中安装结构化克隆的 generation。bootstrap bundle 不静态导入任何包。源码 Worker 入口保留自包含依赖，第三方 Worker 不接受注入。
+- **由 consumer 持有严格语义。** 普通 Loader group 保留成功 sibling。App-boot 在首次结算后应用全局 required-entry policy；agent preset 与动态多 entry 组合在需要 all-or-nothing setup 时，持有并拆卸各自的独立 Loader 子树。App-boot 读取 failed fiber 来报告已记录的错误，并在一个进程检查点内合并 Loader 重复的 rejection 通知。
+- **唯一 runtime resolution。** 安装优先、有序 bundle 逐根 breadth-first 遍历生成运行时表。runtime 解析不创建链接；runtime resolution 条目占据 `$DSH_HOME/profiles/node_modules` 上各自的包名位置，其余包名把该目录当作普通祖先。profile 加载时删除 Link 后端发布版写进 profile 的 `.dsh-module-fallback` 投影；pnpm 安装的包保留。package `imports` 选中的外部 bare target 使用相同的选包顺序，映射、conditions 和精确 target 解析仍由 Node 负责。完整后继 runtime resolution 可以原子增加 package name，修改或删除既有映射则要求重启。
+- **应用自有 profile。** 应用自有 profile 使用相同的 runtime resolution。解析过程不修改其 `node_modules`；已安装包由 pnpm 管理。
+- **自有 Worker。** Worker 构建 banner 会在业务 bundle 前导入 `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap`。每个 Worker 在自己的 isolate 中安装结构化克隆的 runtime resolution。bootstrap bundle 不静态导入任何包。源码 Worker 入口保留自包含依赖，第三方 Worker 不接受注入。
 - **更新完成。** App boot 通过 `internal/update` waterfall 观察重启失败。实时 patch 重载在检查激活状态前等待配置树中的 fiber；单独调用 `Fiber.update()` 或 `Entry.update()` 不能确定重启成功。
 - **单一 rejection 检查点。** `inactiveEntries` 把折入启动诊断的确切原因保持到下一个进程级 rejection 检查点可见，使 `installFailLoud` 能合并 Loader 的重复通知，而所有无关的未处理 rejection 仍然致命。
 - **两阶段失败标签。** 除启动审计失败外，`boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`，并追加最深层插件错误的堆栈。插件诊断保留嵌套原因和聚合错误中的各项失败；原因链出现循环时会停止遍历，但不会替换原始错误。
@@ -131,11 +131,11 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 | 文件 | 职责 |
 |---|---|
 | [`src/index.ts`](src/index.ts) | 启动 helper：配置解析、环境加载、会明确报错的保护机制、激活审计、patch 解析、配置 dump、harness 源码段落 |
-| [`src/profile.ts`](src/profile.ts) | profile 发现、初始化、组合包解析、模块后备机制 |
+| [`src/profile.ts`](src/profile.ts) | profile 发现、初始化、组合包解析、runtime resolution 构造 |
 | [`src/profile-plugins.ts`](src/profile-plugins.ts) | 已安装依赖、bundle 启用策略与 manifest 更新 |
 | [`src/profile-sanitize.ts`](src/profile-sanitize.ts) | profile patch 备份与恢复 bundle 启用状态 |
 | [`src/profile-resolution/`](src/profile-resolution/) | 运行时 resolver、package metadata 服务与构建后 Worker bootstrap |
-| — | 不发布运行时不变式伴生入口；每个 resolver generation 只有一个 registration 所有，dual 模式在解析时比较独立物化的结果。 |
+| — | 不发布运行时不变式伴生入口；每个 runtime resolution 只有一个拦截所有。 |
 
 </details>
 
@@ -173,7 +173,7 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 
 这些限制说明此启动库在何时不合适，或何时需要特别注意。它们是当前包约束，不是任务积压。
 
-- **运行时解析依赖 Node 内部机制**——受支持的 Node 版本需要 native builtin access addon 和可执行兼容验证。只有构建后的 Harness 自有 Worker 接收 generation bootstrap；第三方 Worker 与自定义 `vm` linker 保持原生解析。
+- **运行时解析依赖 Node 内部机制**——受支持的 Node 版本需要 native builtin access addon 和可执行兼容验证。只有构建后的 Harness 自有 Worker 接收 runtime resolution bootstrap；第三方 Worker 与自定义 `vm` linker 保持原生解析。
 - **快照回放替换仅识别特定 basename**——只有以 `cordis.yml` 或 `cordis.yaml` 结尾的配置会映射到同级 `cordis.snapshot.yml`；自定义配置名称需要调用方自行选择。
 - **环境发现以启动为界**——`loadLayeredEnv` 只读取一次调用目录与 harness home 中的 `.env`；它不搜索父目录，也不跟随之后选择的 workspace。`loadEnv` 仍是非产品 bin 使用的单目录 helper。
 - **用户 patch 会替换匹配到的整个配置**——按 id 定位的 patch 不做深度合并，因此 profile 覆盖必须重述需要保留的组合包字段。
diff --git a/packages/boot/app-boot/package.json b/packages/boot/app-boot/package.json
index 1b66d184d1..3b464d917a 100644
--- a/packages/boot/app-boot/package.json
+++ b/packages/boot/app-boot/package.json
@@ -32,7 +32,6 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@deepseek-ai/dsh-atomic-write": "workspace:^",
     "@deepseek-ai/dsh-package-manifest": "workspace:^",
     "js-yaml": "^4.2.0",
     "node-addon-require-builtin": "^0.1.6",
diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts
index 6164f6f080..bb7d055649 100644
--- a/packages/boot/app-boot/src/index.ts
+++ b/packages/boot/app-boot/src/index.ts
@@ -35,13 +35,11 @@ declare module '@deepseek-ai/cordis' {
 
 export {
   composeEntries,
-  createProfileResolutionGeneration,
+  createRuntimeResolution,
   DEFAULT_PROFILE_BUNDLES,
   OPTIONAL_BUNDLES,
-  healProfilesModuleFallback,
-  healIsolatedProfileModuleFallback,
-  unlinkProfileModuleFallback,
   initProfile,
+  removeLinkProjections,
   loadProfile,
   loadProfileDirectory,
   PROFILE_PATCH_FILENAME,
@@ -54,10 +52,9 @@ export {
   type Profile,
   type ProfileLayer,
   type ProfileManifest,
-  type ProfileModuleFallbackOptions,
-  type ProfileResolutionEntry,
-  type ProfileResolutionGeneration,
-  type ProfileResolutionMode,
+  type RuntimeResolutionOptions,
+  type RuntimeResolutionEntry,
+  type RuntimeResolution,
   type ProfileTemplate,
 } from './profile.ts'
 export {
diff --git a/packages/boot/app-boot/src/profile-resolution/legacy-links.ts b/packages/boot/app-boot/src/profile-resolution/legacy-links.ts
index d9eb618d47..6c67762b77 100644
--- a/packages/boot/app-boot/src/profile-resolution/legacy-links.ts
+++ b/packages/boot/app-boot/src/profile-resolution/legacy-links.ts
@@ -1,16 +1,12 @@
-/** Legacy profile-link inspection shared by the disk materializer and runtime resolver. */
+/** Package directory canonicalization through the active runtime carrier's filesystem. */
 
-import { lstatSync, readlinkSync, realpathSync } from 'node:fs'
-import { basename, dirname, join, resolve } from 'node:path'
-
-/** Profile-private package links projected into its pnpm-managed node_modules. */
-export const PROFILE_MODULE_FALLBACK_DIR = '.dsh-module-fallback'
+import { realpathSync } from 'node:fs'
 
 /**
  * Return whether the process reads application modules from pkg's virtual filesystem.
  * @returns whether pkg owns the module filesystem.
  */
-export function isPackagedExecutable(): boolean {
+function isPackagedExecutable(): boolean {
   return (process as NodeJS.Process & { pkg?: unknown }).pkg !== undefined
 }
 
@@ -22,52 +18,3 @@ export function isPackagedExecutable(): boolean {
 export function realModuleDirectory(path: string): string {
   return isPackagedExecutable() ? realpathSync(path) : realpathSync.native(path)
 }
-
-/**
- * Resolve a link target without following the final path component.
- * @param path - candidate path whose parent is canonicalized.
- * @returns the canonical candidate, or undefined when its parent is absent.
- */
-export function canonicalLinkPath(path: string): string | undefined {
-  try {
-    return join(realModuleDirectory(dirname(path)), basename(path))
-  } catch (error) {
-    // A missing parent means the candidate cannot identify an existing owned link.
-    /* v8 ignore next 2 -- a non-ENOENT realpath failure requires a host filesystem fault */
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined
-    /* v8 ignore next -- see the host-filesystem exception above */
-    throw error
-  }
-}
-
-/**
- * Return whether a symlink or junction points at the same path as `target`.
- * @param link - symlink or junction to inspect.
- * @param target - expected target path.
- * @returns whether both paths identify the same entry.
- */
-export function symlinkPointsTo(link: string, target: string): boolean {
-  const actual = resolve(dirname(link), readlinkSync(link))
-  const canonicalActual = canonicalLinkPath(actual)
-  const canonicalTarget = canonicalLinkPath(resolve(target))
-  return canonicalActual !== undefined && canonicalActual === canonicalTarget
-}
-
-/**
- * Return whether an observed profile package must not claim local precedence.
- * @param profileDir - profile directory containing the package projection.
- * @param packageName - bare package name to inspect.
- * @returns whether the entry is a managed fallback link or disappeared during inspection.
- */
-export function isProfileModuleFallbackLink(profileDir: string, packageName: string): boolean {
-  const link = join(profileDir, 'node_modules', packageName)
-  const target = join(profileDir, PROFILE_MODULE_FALLBACK_DIR, 'node_modules', packageName)
-  try {
-    return lstatSync(link).isSymbolicLink() && symlinkPointsTo(link, target)
-  } catch (error) {
-    /* v8 ignore next 2 -- a vanished candidate cannot claim local precedence */
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return true
-    /* v8 ignore next -- non-ENOENT lstat/readlink failures require a host filesystem fault */
-    throw error
-  }
-}
diff --git a/packages/boot/app-boot/src/profile-resolution/resolver.ts b/packages/boot/app-boot/src/profile-resolution/resolver.ts
index 959482c02a..cb6180cd19 100644
--- a/packages/boot/app-boot/src/profile-resolution/resolver.ts
+++ b/packages/boot/app-boot/src/profile-resolution/resolver.ts
@@ -7,8 +7,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { getEnvironmentData, setEnvironmentData } from 'node:worker_threads'
 import type { ModuleLoaderV1, ModuleLoaderV2, ResolveResult } from '@deepseek-ai/cordis-plugin-loader'
 import { imports as resolvePackageImports, type Package as ResolvePackageManifest } from 'resolve.exports'
-import { isProfileModuleFallbackLink } from './legacy-links.ts'
-import type { ProfileResolutionEntry, ProfileResolutionGeneration } from '../profile.ts'
+import type { RuntimeResolutionEntry, RuntimeResolution } from '../profile.ts'
 
 const WORKER_RESOLUTION_KEY = '@deepseek-ai/dsh-app-boot/profile-resolution'
 const EMPTY_ATTRIBUTES: ImportAttributes = Object.freeze({})
@@ -48,9 +47,16 @@ type EsmResolve = (
   request: string, parent: string | undefined, attributes: ImportAttributes,
 ) => ResolveResult | Promise<ResolveResult>
 
+/**
+ * Where Node continues a scoped bare request. `native` keeps the importer's own lookup: the chain is
+ * answered below the interception layer. `interception` answers at the interception layer from the
+ * entry's declaring manifest; `after` anchors Node's chain above the layer for a CommonJS subpath the
+ * entry lacks. `native-after-interception` resumes Node's chain from `parent`: the interception layer for a
+ * name without an entry, or the layer above it after an `interception` subpath miss.
+ */
 type ResolutionRoute =
-  | { readonly kind: 'fallback'; readonly entry: ProfileResolutionEntry; readonly after: string }
-  | { readonly kind: 'after-fallback'; readonly parent: string }
+  | { readonly kind: 'interception'; readonly entry: RuntimeResolutionEntry; readonly after: string }
+  | { readonly kind: 'native-after-interception'; readonly parent: string }
   | { readonly kind: 'native'; readonly packageDir?: string }
 
 interface ResolutionRouteState {
@@ -62,7 +68,8 @@ interface ResolutionRouteState {
 
 interface ParentRoutes {
   readonly parent: string
-  readonly profilesDir: string
+  /** Profile directory owning the importer; its node_modules are local, the first ancestor above it is the interception layer. */
+  readonly localRoot: string
   readonly activeProfile: boolean
   readonly requests: Map<string, ResolutionRouteState>
   selfReferenceName?: string | false | null
@@ -70,8 +77,8 @@ interface ParentRoutes {
 
 type ResolutionRoutes = Map<string, ParentRoutes | false>
 
-interface CompiledGeneration {
-  readonly entries: ReadonlyMap<string, ProfileResolutionEntry>
+interface CompiledResolution {
+  readonly entries: ReadonlyMap<string, RuntimeResolutionEntry>
   readonly profilesDir: string
   readonly profileDir: string | undefined
   readonly profilePaths: readonly string[]
@@ -79,16 +86,12 @@ interface CompiledGeneration {
   readonly profile: readonly string[]
   readonly activeProfileUrls: readonly string[]
   readonly localPackageNames: ReadonlySet<string>
-  readonly shared: ReadonlySet<string>
   readonly esmRoutes: ResolutionRoutes
   readonly cjsRoutes: ResolutionRoutes
 }
 
-/** Whether runtime resolution redirects requests or verifies the materialized backend. */
-export type ProfileResolutionBehavior = 'enforce' | 'verify'
-
-/** Active resolver registration in one Node isolate. */
-export interface ProfileResolutionRegistration {
+/** Active interception in one Node isolate. */
+export interface RuntimeInterception {
   /**
    * Locate a bare package without requiring one of its exports.
    * @param specifier - bare package or package-subpath specifier.
@@ -97,12 +100,12 @@ export interface ProfileResolutionRegistration {
    */
   packageDir(specifier: string, parentURL: string): string | undefined
   /**
-   * Atomically publish an additive package table and fresh generation-owned caches.
-   * @param generation - fully constructed successor generation.
+   * Atomically publish an additive package table and fresh caches.
+   * @param successor - fully constructed additive successor generation.
    * @throws when the profile scope or an existing package mapping changes.
    */
-  replace(generation: ProfileResolutionGeneration): void
-  /** Restore the native resolver methods. Registrations dispose in reverse order. */
+  replace(successor: RuntimeResolution): void
+  /** Restore the native resolver methods. Interceptions dispose in reverse order. */
   dispose(): void
 }
 
@@ -125,7 +128,7 @@ function canonicalPath(path: string): string {
   try {
     return realpathSync(path)
   } catch {
-    // A generation may name a profile scope before that directory is materialized.
+    // A runtime resolution may name a profile scope before that directory is materialized.
     return resolve(path)
   }
 }
@@ -136,19 +139,18 @@ function prefixes(path: string): readonly string[] {
   return canonical === configured ? [configured] : [configured, canonical]
 }
 
-function compileGeneration(generation: ProfileResolutionGeneration): CompiledGeneration {
-  const profilePaths = prefixes(generation.profilesDir)
-  const profile = generation.profileDir === undefined ? [] : prefixes(generation.profileDir)
+function compileResolution(resolution: RuntimeResolution): CompiledResolution {
+  const profilePaths = prefixes(resolution.profilesDir)
+  const profile = resolution.profileDir === undefined ? [] : prefixes(resolution.profileDir)
   return {
-    entries: new Map(generation.entries.map(entry => [entry.name, entry])),
-    profilesDir: generation.profilesDir,
-    profileDir: generation.profileDir,
+    entries: new Map(resolution.entries.map(entry => [entry.name, entry])),
+    profilesDir: resolution.profilesDir,
+    profileDir: resolution.profileDir,
     profilePaths,
     profileUrls: profilePaths.map(path => pathToFileURL(path).href),
     profile,
     activeProfileUrls: profile.map(path => pathToFileURL(path).href),
-    localPackageNames: new Set(generation.localPackageNames),
-    shared: new Set(profilePaths.map(prefix => join(prefix, 'node_modules'))),
+    localPackageNames: new Set(resolution.localPackageNames),
     esmRoutes: new Map(),
     cjsRoutes: new Map(),
   }
@@ -161,6 +163,18 @@ function startsWithin(path: string, roots: readonly string[]): boolean {
   return false
 }
 
+/**
+ * The profile directory owning a module inside the profiles tree: the first path segment below the tree root.
+ * @param path - module path below `treePrefix`.
+ * @param treePrefix - profiles directory with a trailing separator.
+ * @returns the profile directory without a trailing separator.
+ */
+function profileChild(path: string, treePrefix: string): string {
+  const rest = path.slice(treePrefix.length)
+  const end = rest.indexOf(sep)
+  return treePrefix + (end < 0 ? rest : rest.slice(0, end))
+}
+
 function nativePackageDir(parent: string, name: string): string | undefined {
   for (const searchPath of createRequire(parent).resolve.paths(name) as string[]) {
     const candidate = join(searchPath, name)
@@ -169,16 +183,14 @@ function nativePackageDir(parent: string, name: string): string | undefined {
   return undefined
 }
 
-function localPackageCandidate(
-  searchPath: string, name: string, flavor: 'esm' | 'cjs',
-): { packageDir: string; canBeManagedLink: boolean } | undefined {
+function localPackageCandidate(searchPath: string, name: string, flavor: 'esm' | 'cjs'): string | undefined {
   const candidate = join(searchPath, name)
   const stat = statSync(candidate, { throwIfNoEntry: false })
   const found = flavor === 'esm'
     ? stat?.isDirectory() === true
     : stat !== undefined
       || ['.js', '.json', '.node'].some(extension => existsSync(candidate + extension))
-  return found ? { packageDir: candidate, canBeManagedLink: stat !== undefined } : undefined
+  return found ? candidate : undefined
 }
 
 function selfReferenceName(parent: string): string | false | null {
@@ -243,10 +255,10 @@ function packageImportsTarget(
 }
 
 function packageSearchPaths(
-  entry: ProfileResolutionEntry, request: string, cjs: CommonJsModule,
+  entry: RuntimeResolutionEntry, request: string, cjs: CommonJsModule,
 ): string[] {
   const name = barePackageName(request)
-  /* v8 ignore next -- fallback routes are created only for bare package requests */
+  /* v8 ignore next -- interception routes are created only for bare package requests */
   if (name === undefined) return cjs._nodeModulePaths(dirname(entry.declarer))
   const suffix = sep + name.split('/').join(sep)
   return entry.packageDir.endsWith(suffix)
@@ -280,24 +292,22 @@ function isUnselectedPackageMiss(error: unknown): boolean {
 
 function sameResolution(left: string, right: string): boolean {
   if (left === right) return true
-  const leftPath = left.startsWith('file:') ? fileURLToPath(left) : left
-  const rightPath = right.startsWith('file:') ? fileURLToPath(right) : right
-  return canonicalPath(leftPath) === canonicalPath(rightPath)
+  return canonicalPath(left) === canonicalPath(right)
 }
 
-/** One mutable pointer to immutable generation data. */
+/** One mutable pointer to the immutable runtime resolution. */
 class ResolutionRouter {
-  private current: CompiledGeneration
+  private current: CompiledResolution
 
-  constructor(generation: ProfileResolutionGeneration) {
-    this.current = compileGeneration(generation)
+  constructor(resolution: RuntimeResolution) {
+    this.current = compileResolution(resolution)
   }
 
-  replace(generation: ProfileResolutionGeneration): void {
-    const entries = new Map(generation.entries.map(entry => [entry.name, entry]))
-    if (generation.profilesDir !== this.current.profilesDir
-      || generation.profileDir !== this.current.profileDir) {
-      throw new Error('profile resolution: a generation cannot change its profile scope')
+  replace(successor: RuntimeResolution): void {
+    const entries = new Map(successor.entries.map(entry => [entry.name, entry]))
+    if (successor.profilesDir !== this.current.profilesDir
+      || successor.profileDir !== this.current.profileDir) {
+      throw new Error('profile resolution: a successor cannot change its profile scope')
     }
     for (const [name, current] of this.current.entries) {
       const next = entries.get(name)
@@ -309,7 +319,7 @@ class ResolutionRouter {
         throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`)
       }
     }
-    const localPackageNames = new Set(generation.localPackageNames)
+    const localPackageNames = new Set(successor.localPackageNames)
     for (const name of this.current.localPackageNames) {
       if (!localPackageNames.has(name)) {
         throw new Error(`profile resolution: removing local package ${JSON.stringify(name)} requires a process restart`)
@@ -320,18 +330,18 @@ class ResolutionRouter {
         throw new Error(`profile resolution: overriding ${JSON.stringify(name)} locally requires a process restart`)
       }
     }
-    this.current = compileGeneration(generation)
+    this.current = compileResolution(successor)
   }
 
   private routeScoped(
     request: string,
     parentRoutes: ParentRoutes,
-    generation: CompiledGeneration,
+    resolution: CompiledResolution,
     flavor: 'esm' | 'cjs',
     nativeResolve?: (searchPaths: readonly string[]) => string,
     cacheable = false,
   ): ResolutionRouteState | undefined {
-    const { parent, profilesDir, requests } = parentRoutes
+    const { parent, localRoot, requests } = parentRoutes
     const name = barePackageName(request)
     if (name === undefined) return undefined
 
@@ -344,32 +354,27 @@ class ResolutionRouter {
       return state
     }
 
-    const target = generation.entries.get(name)
-    const candidates: Array<{ packageDir: string; canBeManagedLink: boolean }> = []
+    const target = resolution.entries.get(name)
+    const candidates: string[] = []
     const localSearchPaths: string[] = []
+    const localPrefix = localRoot + sep
     for (const searchPath of createRequire(parent).resolve.paths(name) as string[]) {
-      if (generation.shared.has(resolve(searchPath))) break
+      if (!searchPath.startsWith(localPrefix)) break
       localSearchPaths.push(searchPath)
       const candidate = localPackageCandidate(searchPath, name, flavor)
-      if (candidate !== undefined) {
-        const legacy = candidate.canBeManagedLink && generation.profile.some(prefix => (
-          candidate.packageDir === join(prefix, 'node_modules', name)
-          && isProfileModuleFallbackLink(prefix.slice(0, -1), name)
-        ))
-        if (!legacy) candidates.push(candidate)
-      }
+      if (candidate !== undefined) candidates.push(candidate)
     }
     if (candidates.length > 0) {
       if (flavor === 'cjs' && nativeResolve !== undefined) {
         try {
           const resolved = nativeResolve(localSearchPaths)
           const selected = candidates.find(candidate => (
-            localCandidateOwnsResolution(candidate.packageDir, resolved, request, name)
+            localCandidateOwnsResolution(candidate, resolved, request, name)
           ))
           if (selected !== undefined) {
             const state = {
-              route: { kind: 'native' as const, packageDir: selected.packageDir },
-              packageDir: selected.packageDir,
+              route: { kind: 'native' as const, packageDir: selected },
+              packageDir: selected,
               ...(cacheable ? { cjs: resolved } : {}),
             }
             requests.set(request, state)
@@ -379,104 +384,95 @@ class ResolutionRouter {
           if (!isUnselectedPackageMiss(error)) throw error
         }
       } else {
-        const selected = candidates[0] as { packageDir: string }
+        const selected = candidates[0] as string
         const state = {
-          route: { kind: 'native' as const, packageDir: selected.packageDir },
-          packageDir: selected.packageDir,
+          route: { kind: 'native' as const, packageDir: selected },
+          packageDir: selected,
         }
         requests.set(request, state)
         return state
       }
     }
 
+    // The interception layer is `<profileParent>/node_modules`: a runtime resolution entry occupies its name
+    // there, so its subpath misses continue above it; a name without an entry continues at it.
+    const profileParent = dirname(localRoot)
     const eligible = target?.scope === 'installation'
       || (target?.scope === 'profile' && parentRoutes.activeProfile)
-    const after = join(dirname(profilesDir), 'package.json')
     const route: ResolutionRoute = eligible
-      ? { kind: 'fallback', entry: target, after }
-      : { kind: 'after-fallback', parent: after }
+      ? { kind: 'interception', entry: target, after: join(dirname(profileParent), 'package.json') }
+      : { kind: 'native-after-interception', parent: join(profileParent, 'package.json') }
     const state: ResolutionRouteState = { route }
-    if (route.kind === 'fallback') requests.set(request, state)
+    if (route.kind === 'interception') requests.set(request, state)
     return state
   }
 
   private routeLocalPackage(
-    request: string, parentRoutes: ParentRoutes, generation: CompiledGeneration,
+    request: string, parentRoutes: ParentRoutes, resolution: CompiledResolution,
   ): ResolutionRouteState | undefined {
     const name = barePackageName(request)
-    if (name === undefined || !parentRoutes.activeProfile || !generation.localPackageNames.has(name)) return undefined
+    if (name === undefined || !parentRoutes.activeProfile || !resolution.localPackageNames.has(name)) return undefined
     const state = { route: { kind: 'native' as const } }
     parentRoutes.requests.set(request, state)
     return state
   }
 
   routeUrl(request: string, parentURL: string): ResolutionRouteState | undefined {
-    const generation = this.current
-    let parentRoutes = generation.esmRoutes.get(parentURL)
+    const resolution = this.current
+    let parentRoutes = resolution.esmRoutes.get(parentURL)
     if (parentRoutes === false) return undefined
     const cached = parentRoutes?.requests.get(request)
     if (cached !== undefined) return cached
     if (parentRoutes === undefined) {
-      const profileIndex = generation.profileUrls.findIndex(prefix => parentURL.startsWith(prefix))
-      const activeProfileIndex = generation.activeProfileUrls.findIndex(prefix => parentURL.startsWith(prefix))
+      const profileIndex = resolution.profileUrls.findIndex(prefix => parentURL.startsWith(prefix))
+      const activeProfileIndex = resolution.activeProfileUrls.findIndex(prefix => parentURL.startsWith(prefix))
       if (profileIndex < 0 && activeProfileIndex < 0) {
-        generation.esmRoutes.set(parentURL, false)
+        resolution.esmRoutes.set(parentURL, false)
         return undefined
       }
       let parent: string
       try {
         parent = fileURLToPath(parentURL)
       } catch {
-        generation.esmRoutes.set(parentURL, false)
+        resolution.esmRoutes.set(parentURL, false)
         return undefined
       }
-      const profileRoot = profileIndex >= 0
-        ? generation.profilePaths[profileIndex]
-        : generation.profile[activeProfileIndex]
+      const treeRoot = resolution.profilePaths[profileIndex]
+      const localRoot = treeRoot !== undefined
+        ? profileChild(parent, treeRoot)
+        : resolution.profile[activeProfileIndex]?.slice(0, -1)
       /* v8 ignore next -- one matching index was established above */
-      if (profileRoot === undefined) return undefined
-      parentRoutes = {
-        parent,
-        profilesDir: profileRoot.slice(0, -1),
-        activeProfile: activeProfileIndex >= 0,
-        requests: new Map(),
-      }
-      generation.esmRoutes.set(parentURL, parentRoutes)
+      if (localRoot === undefined) return undefined
+      parentRoutes = { parent, localRoot, activeProfile: activeProfileIndex >= 0, requests: new Map() }
+      resolution.esmRoutes.set(parentURL, parentRoutes)
     }
-    const local = this.routeLocalPackage(request, parentRoutes, generation)
+    const local = this.routeLocalPackage(request, parentRoutes, resolution)
     if (local !== undefined) return local
-    return this.routeScoped(request, parentRoutes, generation, 'esm')
+    return this.routeScoped(request, parentRoutes, resolution, 'esm')
   }
 
   routePath(
     request: string, parent: string, nativeResolve?: (searchPaths: readonly string[]) => string, cacheable = false,
   ): ResolutionRouteState | undefined {
-    const generation = this.current
-    let parentRoutes = generation.cjsRoutes.get(parent)
+    const resolution = this.current
+    let parentRoutes = resolution.cjsRoutes.get(parent)
     if (parentRoutes === false) return undefined
     const cached = parentRoutes?.requests.get(request)
     if (cached !== undefined) return cached
     if (parentRoutes === undefined) {
-      const profilesDir = generation.profilePaths.find(prefix => parent.startsWith(prefix))
-      const activeProfile = generation.profile.find(prefix => parent.startsWith(prefix))
-      if (profilesDir !== undefined || activeProfile !== undefined) {
-        const profileRoot = profilesDir ?? activeProfile
-        /* v8 ignore next -- one matching root was established above */
-        if (profileRoot === undefined) return undefined
-        parentRoutes = {
-          parent,
-          profilesDir: profileRoot.slice(0, -1),
-          activeProfile: activeProfile !== undefined,
-          requests: new Map(),
-        }
-        generation.cjsRoutes.set(parent, parentRoutes)
+      const treeRoot = resolution.profilePaths.find(prefix => parent.startsWith(prefix))
+      const activeProfile = resolution.profile.find(prefix => parent.startsWith(prefix))
+      const localRoot = treeRoot !== undefined ? profileChild(parent, treeRoot) : activeProfile?.slice(0, -1)
+      if (localRoot !== undefined) {
+        parentRoutes = { parent, localRoot, activeProfile: activeProfile !== undefined, requests: new Map() }
+        resolution.cjsRoutes.set(parent, parentRoutes)
       }
     }
     if (parentRoutes === undefined) {
-      generation.cjsRoutes.set(parent, false)
+      resolution.cjsRoutes.set(parent, false)
       return undefined
     }
-    return this.routeScoped(request, parentRoutes, generation, 'cjs', nativeResolve, cacheable)
+    return this.routeScoped(request, parentRoutes, resolution, 'cjs', nativeResolve, cacheable)
   }
 
   explicitRoute(
@@ -503,11 +499,11 @@ class ResolutionRouter {
     const name = barePackageName(specifier)
     if (name === undefined) return undefined
     const state = this.routeUrl(specifier, parentURL)
-    if (state?.route.kind === 'fallback') return state.route.entry.packageDir
+    if (state?.route.kind === 'interception') return state.route.entry.packageDir
     if (state?.packageDir !== undefined) return state.packageDir
     let parent: string
     try {
-      parent = state?.route.kind === 'after-fallback' ? state.route.parent : fileURLToPath(parentURL)
+      parent = state?.route.kind === 'native-after-interception' ? state.route.parent : fileURLToPath(parentURL)
     } catch {
       return undefined
     }
@@ -597,39 +593,20 @@ function throwWithoutCjsAnchor(error: unknown, anchor: string): never {
   throw error
 }
 
-function assertEquivalent(actual: string, expected: string, request: string, parent: string): void {
-  if (sameResolution(actual, expected)) return
-  throw new Error(
-    `profile resolution mismatch for ${JSON.stringify(request)} from ${parent}: disk resolved ${actual}, generation resolved ${expected}`,
-  )
-}
-
-function assertOptionalEquivalent(
-  actual: string | undefined, expected: string | undefined, request: string, parent: string,
-): void {
-  if (actual === undefined && expected === undefined) return
-  if (actual !== undefined && expected !== undefined && sameResolution(actual, expected)) return
-  throw new Error(
-    `profile resolution mismatch for ${JSON.stringify(request)} from ${parent}: disk selected ${actual ?? 'nothing'}, generation selected ${expected ?? 'nothing'}`,
-  )
-}
-
 /**
- * Install one profile generation on Node's default ESM and CommonJS resolvers.
- * @param generation - complete package table and profile scope.
- * @param behavior - enforce the generation, or verify a materialized generation.
- * @returns a registration that replaces the generation or restores the native methods.
+ * Install one runtime resolution as the interception on Node's default ESM and CommonJS resolvers.
+ * @param resolution - complete package table and profile scope.
+ * @returns an interception that publishes a successor or restores the native methods.
  */
-export function installProfileResolution(
-  generation: ProfileResolutionGeneration,
-  behavior: ProfileResolutionBehavior = 'enforce',
-): ProfileResolutionRegistration {
-  const router = new ResolutionRouter(generation)
+export function installRuntimeInterception(
+  resolution: RuntimeResolution,
+): RuntimeInterception {
+  const router = new ResolutionRouter(resolution)
   const { esm, esmDefaultResolve, esmConditions, cjs, cjsConditions, modern } = internalModules()
   const esmScope = new Map<string, boolean>()
   const profilePaths = [
-    ...prefixes(generation.profilesDir),
-    ...(generation.profileDir === undefined ? [] : prefixes(generation.profileDir)),
+    ...prefixes(resolution.profilesDir),
+    ...(resolution.profileDir === undefined ? [] : prefixes(resolution.profileDir)),
   ]
   const profileUrls = profilePaths.map(path => pathToFileURL(path).href)
   let recentEsmParent: string | undefined
@@ -669,18 +646,7 @@ export function installProfileResolution(
         } catch (error) {
           return restoreImporter(error)
         }
-        if (behavior === 'enforce') return expected
-        const actual = native(request, parent, attributes)
-        /* v8 ignore start -- Node 22 is the asynchronous adapter and is covered by the external version matrix */
-        if (expected instanceof Promise || actual instanceof Promise) {
-          return Promise.all([actual, expected]).then(([resolved, wanted]) => {
-            assertEquivalent(resolved.url, wanted.url, request, parent)
-            return resolved
-          })
-        }
-        /* v8 ignore stop */
-        assertEquivalent(actual.url, expected.url, request, parent)
-        return actual
+        return expected
       }
       const cacheable = attributes === EMPTY_ATTRIBUTES || Object.keys(attributes).length === 0
       if (cacheable && state.esm !== undefined) return state.esm
@@ -690,52 +656,21 @@ export function installProfileResolution(
         if (cacheable && !(result instanceof Promise)) state.esm = result
         return result
       }
-      const routedParent = pathToFileURL(route.kind === 'fallback' ? route.entry.declarer : route.parent).href
-      if (behavior === 'enforce') {
-        const previous = delegatedEsm
-        delegatedEsm = { parent: routedParent, request }
-        const restoreImporter = (error: unknown): never => throwWithImporter(error, routedParent, parent)
-        try {
-          let result: ResolveResult | Promise<ResolveResult>
-          try {
-            result = native(request, routedParent, attributes)
-          } catch (error) {
-            return restoreImporter(error)
-          }
-          /* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
-          if (result instanceof Promise) return result.catch(restoreImporter)
-          if (cacheable) state.esm = result
-          return result
-        } finally {
-          delegatedEsm = previous
-        }
-      }
-      const actual = native(request, parent, attributes)
+      const routedParent = pathToFileURL(route.kind === 'interception' ? route.entry.declarer : route.parent).href
       const previous = delegatedEsm
       delegatedEsm = { parent: routedParent, request }
       const restoreImporter = (error: unknown): never => throwWithImporter(error, routedParent, parent)
       try {
-        let expected: ResolveResult | Promise<ResolveResult>
+        let result: ResolveResult | Promise<ResolveResult>
         try {
-          const result = native(request, routedParent, attributes)
-          expected = result
-          /* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
-          if (result instanceof Promise) expected = result.catch(restoreImporter)
+          result = native(request, routedParent, attributes)
         } catch (error) {
           return restoreImporter(error)
         }
-        /* v8 ignore start -- Node 22 is the asynchronous adapter and is covered by the external version matrix */
-        if (expected instanceof Promise || actual instanceof Promise) {
-          return Promise.all([actual, expected]).then(([resolved, wanted]) => {
-            assertEquivalent(resolved.url, wanted.url, request, parent)
-            if (cacheable) state.esm = resolved
-            return resolved
-          })
-        }
-        /* v8 ignore stop */
-        assertEquivalent(actual.url, expected.url, request, parent)
-        if (cacheable) state.esm = actual
-        return actual
+        /* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+        if (result instanceof Promise) return result.catch(restoreImporter)
+        if (cacheable) state.esm = result
+        return result
       } finally {
         delegatedEsm = previous
       }
@@ -760,7 +695,7 @@ export function installProfileResolution(
     )
     loader.resolveSync = wrapped
     restoreEsm = () => {
-      /* v8 ignore else -- registrations are disposed in reverse installation order */
+      /* v8 ignore else -- interceptions are disposed in reverse installation order */
       if (loader.resolveSync === wrapped) loader.resolveSync = original
     }
   } else {
@@ -789,12 +724,12 @@ export function installProfileResolution(
     request: string, routed: Exclude<ResolutionRoute, { kind: 'native' }>,
     parent: CommonJsParent, main: boolean, options?: CommonJsOptions,
   ): string => {
-    const anchor = routed.kind === 'fallback' ? routed.entry.declarer : routed.parent
+    const anchor = routed.kind === 'interception' ? routed.entry.declarer : routed.parent
     const synthetic = new cjs(anchor)
     // Late parent assignment preserves Node's require stack without publishing this routing anchor in parent.children.
     synthetic.parent = parent
     synthetic.filename = anchor
-    synthetic.paths = routed.kind === 'fallback'
+    synthetic.paths = routed.kind === 'interception'
       ? packageSearchPaths(routed.entry, request, cjs)
       : cjs._nodeModulePaths(dirname(anchor))
     try {
@@ -825,7 +760,7 @@ export function installProfileResolution(
     if (state === undefined) return resolveFrom(target.parentURL)
     if (state.route.kind === 'native') return resolveFrom(target.parentURL)
     const route = state.route
-    if (route.kind === 'after-fallback') return resolveFrom(pathToFileURL(route.parent).href)
+    if (route.kind === 'native-after-interception') return resolveFrom(pathToFileURL(route.parent).href)
     return resolveFrom(pathToFileURL(route.entry.declarer).href)
   }
   const wrappedFilename: CommonJsModule['_resolveFilename'] = (request, parent, main, options) => {
@@ -867,11 +802,7 @@ export function installProfileResolution(
         ? packageImportsTarget(parentFilename, request, conditions)
         : undefined
       if (target === undefined) return originalFilename.call(cjs, request, parent, main, options)
-      const expected = resolvePackageImportCjs(target, conditions)
-      if (behavior === 'enforce') return expected
-      const actual = originalFilename.call(cjs, request, parent, main, options)
-      assertEquivalent(actual, expected, request, parentFilename)
-      return actual
+      return resolvePackageImportCjs(target, conditions)
     }
     if (cacheable && state.cjs !== undefined) return state.cjs
     const route = state.route
@@ -880,7 +811,7 @@ export function installProfileResolution(
       if (cacheable) state.cjs = result
       return result
     }
-    if (route.kind === 'after-fallback' && explicit !== undefined && explicitPaths !== undefined) {
+    if (route.kind === 'native-after-interception' && explicit !== undefined && explicitPaths !== undefined) {
       try {
         return originalFilename.call(cjs, request, parent, main, {
           ...options,
@@ -900,10 +831,10 @@ export function installProfileResolution(
       try {
         expected = resolveRoutedCjs(request, route, parent, main, routedOptions)
       } catch (error) {
-        if (route.kind !== 'fallback' || !isUnselectedPackageMiss(error)) throw error
+        if (route.kind !== 'interception' || !isUnselectedPackageMiss(error)) throw error
         try {
           expected = resolveRoutedCjs(
-            request, { kind: 'after-fallback', parent: route.after }, parent, main, routedOptions,
+            request, { kind: 'native-after-interception', parent: route.after }, parent, main, routedOptions,
           )
         } catch (afterError) {
           const remaining = explicit === undefined || explicitPaths === undefined
@@ -920,14 +851,8 @@ export function installProfileResolution(
           }
         }
       }
-      if (behavior === 'enforce') {
-        if (cacheable) state.cjs = expected
-        return expected
-      }
-      const actual = originalFilename.call(cjs, request, parent, main, options)
-      assertEquivalent(actual, expected, request, parentFilename)
-      if (cacheable) state.cjs = actual
-      return actual
+      if (cacheable) state.cjs = expected
+      return expected
     } finally {
       delegatedCjs--
     }
@@ -936,23 +861,11 @@ export function installProfileResolution(
 
   return {
     packageDir(specifier, parentURL) {
-      const expected = router.packageDir(specifier, parentURL)
-      if (behavior !== 'verify' || !startsWithin(parentURL, profileUrls)) return expected
-      const name = barePackageName(specifier)
-      if (name === undefined) return expected
-      let parent: string
-      try {
-        parent = fileURLToPath(parentURL)
-      } catch {
-        return expected
-      }
-      const actual = nativePackageDir(parent, name)
-      assertOptionalEquivalent(actual, expected, specifier, parentURL)
-      return expected
+      return router.packageDir(specifier, parentURL)
     },
     replace(next) { router.replace(next) },
     dispose() {
-      /* v8 ignore else -- registrations are disposed in reverse installation order */
+      /* v8 ignore else -- interceptions are disposed in reverse installation order */
       if (cjs._resolveFilename === wrappedFilename) cjs._resolveFilename = originalFilename
       restoreEsm()
     },
@@ -960,16 +873,14 @@ export function installProfileResolution(
 }
 
 /**
- * Publish one generation for Harness-owned Workers.
- * @param generation - complete package table and profile scope.
- * @param behavior - enforce or verify the generation in newly created Workers.
+ * Publish one runtime resolution for Harness-owned Workers.
+ * @param resolution - complete package table and profile scope.
  * @returns a disposer restoring the previous thread environment data.
  */
 export function registerWorkerResolution(
-  generation: ProfileResolutionGeneration,
-  behavior: ProfileResolutionBehavior = 'enforce',
+  resolution: RuntimeResolution,
 ): () => void {
   const previous = getEnvironmentData(WORKER_RESOLUTION_KEY)
-  setEnvironmentData(WORKER_RESOLUTION_KEY, { generation, behavior })
+  setEnvironmentData(WORKER_RESOLUTION_KEY, { resolution })
   return () => { setEnvironmentData(WORKER_RESOLUTION_KEY, previous) }
 }
diff --git a/packages/boot/app-boot/src/profile-resolution/service.ts b/packages/boot/app-boot/src/profile-resolution/service.ts
index 3281f42ce5..f0b92228dd 100644
--- a/packages/boot/app-boot/src/profile-resolution/service.ts
+++ b/packages/boot/app-boot/src/profile-resolution/service.ts
@@ -1,4 +1,4 @@
-/** Package metadata resolved through one profile resolution registration. */
+/** Package metadata resolved through one runtime interception. */
 
 import { existsSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
@@ -6,12 +6,11 @@ import { join } from 'node:path'
 import { Service, type Context } from '@deepseek-ai/cordis'
 import {
   barePackageName,
-  installProfileResolution,
+  installRuntimeInterception,
   registerWorkerResolution,
-  type ProfileResolutionBehavior,
-  type ProfileResolutionRegistration,
+  type RuntimeInterception,
 } from './resolver.ts'
-import type { ProfileResolutionGeneration } from '../profile.ts'
+import type { RuntimeResolution } from '../profile.ts'
 
 declare module '@deepseek-ai/cordis' {
   interface Context {
@@ -34,12 +33,10 @@ export interface PluginPackage {
   manifest: Record<string, unknown>
 }
 
-/** Optional runtime resolver installed and owned by {@link PluginPackages}. */
+/** Optional runtime interception installed and owned by {@link PluginPackages}. */
 export interface PluginPackagesConfig {
   /** Complete package table; omit it to expose native package lookup only. */
-  generation?: ProfileResolutionGeneration
-  /** Enforce the table or compare it with a materialized fallback. */
-  behavior?: ProfileResolutionBehavior
+  resolution?: RuntimeResolution
 }
 
 function readPackage(dir: string, fallbackName: string): PluginPackage | undefined {
@@ -60,33 +57,31 @@ function readPackage(dir: string, fallbackName: string): PluginPackage | undefin
 /** Package lookup shared by metadata consumers in one profile process. */
 export class PluginPackages extends Service {
   private packages = new Map<string, PluginPackage | undefined>()
-  private readonly resolver: ProfileResolutionRegistration | undefined
-  private readonly behavior: ProfileResolutionBehavior
+  private readonly interception: RuntimeInterception | undefined
   private disposeWorkerResolution: (() => void) | undefined
 
   constructor(ctx: Context, config: PluginPackagesConfig = {}) {
     super(ctx, 'pluginPackages')
-    this.behavior = config.behavior ?? 'enforce'
-    if (config.generation === undefined) return
-    const resolver = installProfileResolution(config.generation, this.behavior)
-    this.disposeWorkerResolution = registerWorkerResolution(config.generation, this.behavior)
-    this.resolver = resolver
+    if (config.resolution === undefined) return
+    const interception = installRuntimeInterception(config.resolution)
+    this.disposeWorkerResolution = registerWorkerResolution(config.resolution)
+    this.interception = interception
     ctx.effect(() => () => {
       this.disposeWorkerResolution?.()
-      resolver.dispose()
+      interception.dispose()
     }, 'profile package resolution')
   }
 
   /**
-   * Publish an additive generation for this process and subsequently created Workers.
-   * @param generation - fully constructed successor generation.
+   * Publish an additive successor generation for this process and subsequently created Workers.
+   * @param successor - fully constructed successor generation.
    */
-  replace(generation: ProfileResolutionGeneration): void {
-    if (this.resolver === undefined) throw new Error('plugin-packages: runtime resolution is not installed')
-    this.resolver.replace(generation)
+  replace(successor: RuntimeResolution): void {
+    if (this.interception === undefined) throw new Error('plugin-packages: runtime resolution is not installed')
+    this.interception.replace(successor)
     this.packages = new Map()
     this.disposeWorkerResolution?.()
-    this.disposeWorkerResolution = registerWorkerResolution(generation, this.behavior)
+    this.disposeWorkerResolution = registerWorkerResolution(successor)
   }
 
   /**
@@ -98,9 +93,9 @@ export class PluginPackages extends Service {
   packageOf(specifier: string, parentURL: string): PluginPackage | undefined {
     const name = barePackageName(specifier)
     if (name === undefined) return undefined
-    const dir = this.resolver === undefined
+    const dir = this.interception === undefined
       ? packageDirFromParent(name, parentURL)
-      : this.resolver.packageDir(name, parentURL)
+      : this.interception.packageDir(name, parentURL)
     if (dir === undefined) return undefined
     const key = JSON.stringify({ dir, name })
     if (!this.packages.has(key)) this.packages.set(key, readPackage(dir, name))
diff --git a/packages/boot/app-boot/src/profile-resolution/worker-bootstrap.ts b/packages/boot/app-boot/src/profile-resolution/worker-bootstrap.ts
index f7258d42f3..f19b5a281b 100644
--- a/packages/boot/app-boot/src/profile-resolution/worker-bootstrap.ts
+++ b/packages/boot/app-boot/src/profile-resolution/worker-bootstrap.ts
@@ -1,13 +1,12 @@
-/** Install an inherited profile resolution generation in one Harness-owned Worker. */
+/** Install the inherited runtime resolution in one Harness-owned Worker. */
 
 import { getEnvironmentData } from 'node:worker_threads'
-import { installProfileResolution, type ProfileResolutionBehavior } from './resolver.ts'
-import type { ProfileResolutionGeneration } from '../profile.ts'
+import { installRuntimeInterception } from './resolver.ts'
+import type { RuntimeResolution } from '../profile.ts'
 
 const registration = getEnvironmentData(
   '@deepseek-ai/dsh-app-boot/profile-resolution',
 ) as {
-  generation: ProfileResolutionGeneration
-  behavior: ProfileResolutionBehavior
+  resolution: RuntimeResolution
 } | undefined
-if (registration !== undefined) installProfileResolution(registration.generation, registration.behavior)
+if (registration !== undefined) installRuntimeInterception(registration.resolution)
diff --git a/packages/boot/app-boot/src/profile.ts b/packages/boot/app-boot/src/profile.ts
index d4f70fd398..dec0f4b13c 100644
--- a/packages/boot/app-boot/src/profile.ts
+++ b/packages/boot/app-boot/src/profile.ts
@@ -15,36 +15,20 @@
  * Module resolution is two-anchor by construction: a bundle name resolves
  * first from the dsh installation (the launcher's own package), then from the
  * profile directory. Pnpm-managed entries in the profile's `node_modules`
- * resolve first. Dsh-owned links add packages carried only by selected
- * bundles, while `$DSH_HOME/profiles/node_modules` supplies the installation
- * dependency closure through Node's ordinary parent-walk. Plain Node uses
- * symlinks for that shared fallback; packaged executables use ESM proxies so
- * external plugins retain the installation's module instances.
+ * resolve first. The runtime resolution supplies packages carried by the
+ * installation and selected bundles to Node's ESM and CommonJS resolvers.
  * @module @deepseek-ai/dsh-app-boot/profile
  */
 
 import { createRequire } from 'node:module'
-import {
-  existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, rmSync, statSync,
-  symlinkSync, unlinkSync, writeFileSync,
-} from 'node:fs'
-import { basename, dirname, join, relative, resolve } from 'node:path'
-import { pathToFileURL } from 'node:url'
-import { withFileLock } from '@deepseek-ai/dsh-atomic-write'
+import { existsSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmSync, unlinkSync, writeFileSync } from 'node:fs'
+import { basename, dirname, join, resolve, sep } from 'node:path'
 import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
 import { applyEntryPatches, type PatchOptions } from '@deepseek-ai/cordis-plugin-include'
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
 import type { DshPackageManifest } from '@deepseek-ai/dsh-package-manifest'
-import { resolve as resolvePackage, type Package as ResolvePackageManifest } from 'resolve.exports'
 import { loadOverlayPatches } from './index.ts'
-import {
-  canonicalLinkPath,
-  isPackagedExecutable,
-  isProfileModuleFallbackLink,
-  PROFILE_MODULE_FALLBACK_DIR,
-  realModuleDirectory,
-  symlinkPointsTo,
-} from './profile-resolution/legacy-links.ts'
+import { realModuleDirectory } from './profile-resolution/legacy-links.ts'
 
 /** Directory under the Harness home holding every profile. */
 export const PROFILES_DIR = 'profiles'
@@ -87,8 +71,8 @@ export interface Profile {
   patches: PatchOptions[]
 }
 
-/** One package selected by the profile module-fallback rules. */
-export interface ProfileResolutionEntry {
+/** One package the runtime resolution supplies at the interception layer. */
+export interface RuntimeResolutionEntry {
   /** Bare package name. */
   readonly name: string
   /** Package directory selected by the existing dependency traversal. */
@@ -97,25 +81,22 @@ export interface ProfileResolutionEntry {
   readonly version: string | undefined
   /** Manifest whose dependency edge selected this package. */
   readonly declarer: string
-  /** Whether every profile or only the active profile receives this fallback. */
+  /** Whether every profile or only the active profile receives this entry. */
   readonly scope: 'installation' | 'profile'
 }
 
-/** Complete immutable fallback table for one profile launch. */
-export interface ProfileResolutionGeneration {
-  /** Directory containing every profile and the shared fallback position. */
+/** Complete immutable package table for one profile launch. */
+export interface RuntimeResolution {
+  /** Directory containing every profile; its node_modules is the interception layer. */
   readonly profilesDir: string
-  /** Active profile directory, when bundle-only fallbacks were included. */
+  /** Active profile directory, when profile-scope entries were included. */
   readonly profileDir: string | undefined
-  /** Profile-declared packages already installed before the fallback position. */
+  /** Profile-declared packages installed in the profile's own node_modules. */
   readonly localPackageNames: readonly string[]
-  /** Installation entries followed by bundle-only entries in precedence order. */
-  readonly entries: readonly ProfileResolutionEntry[]
+  /** Installation-scope entries followed by profile-scope entries in precedence order. */
+  readonly entries: readonly RuntimeResolutionEntry[]
 }
 
-/** Startup backend selection for one computed profile resolution generation. */
-export type ProfileResolutionMode = 'link' | 'dual' | 'runtime'
-
 /**
  * Resolve a profile's directory under the Harness home.
  * @param name - the profile name (`dsh --profile <name>`).
@@ -124,7 +105,7 @@ export type ProfileResolutionMode = 'link' | 'dual' | 'runtime'
  */
 export function resolveProfileDir(name: string, home: string = resolveDshHome()): string {
   if (name === '' || name.includes('/') || name.includes('\\') || name === '.' || name === '..'
-    // The launcher-maintained flat module fallback lives at this sibling path.
+    // Node reserves this name for dependency lookup.
     || name === 'node_modules') {
     throw new Error(`dsh: invalid profile name ${JSON.stringify(name)}`)
   }
@@ -175,8 +156,7 @@ const PROFILE_PATCH_TEMPLATE = `# Your patch layer for this dsh profile, applied
 `
 
 // The hoisted linker gives out-of-tree plugins a flat node_modules whose
-// missing peers (cordis and friends) fall through to the healed
-// profiles/node_modules installation fallback, so every plugin shares the
+// missing peers (cordis and friends) use the runtime resolution, so every plugin shares the
 // installation's single cordis instance instead of a duplicate. pnpm ≥10
 // reads its settings from pnpm-workspace.yaml, not .npmrc.
 const PROFILE_PNPM_WORKSPACE = `packages:
@@ -214,249 +194,61 @@ export function initProfile(
   if (!existsSync(workspacePath)) writeFileSync(workspacePath, PROFILE_PNPM_WORKSPACE)
 }
 
-function readModuleProxyRecord(link: string): ModuleProxyRecord | undefined {
-  try {
-    return JSON.parse(readFileSync(join(link, 'package.json'), 'utf8')) as ModuleProxyRecord
-  } catch {
-    // Missing or invalid metadata is not managed state; callers reject it.
-    return undefined
-  }
-}
-
-/** Ensure `link` is a symlink to `target`, replacing a wrong link or a dsh-managed packaged proxy. */
-function ensureSymlink(link: string, target: string): void {
-  let stat
-  try {
-    stat = lstatSync(link)
-  } catch {
-    // Missing link (first run) — created below. Any other lstat failure on a
-    // path we just created the parent of would resurface on symlinkSync.
-    stat = undefined
-  }
-  if (stat !== undefined) {
-    if (!stat.isSymbolicLink()) {
-      const existing = stat.isDirectory() ? readModuleProxyRecord(link) : undefined
-      if (existing?.dsh?.moduleFallback?.targets === undefined) {
-        throw new Error(`dsh: ${link} exists and is not a symlink or dsh-managed module proxy; remove it so dsh can manage the installation fallback`)
-      }
-      rmSync(link, { recursive: true })
-      stat = undefined
-    }
-    if (stat !== undefined) {
-      if (symlinkPointsTo(link, target)) return
-      // unlink deletes the reparse point itself on Windows too; rmSync treats a
-      // junction as a directory and throws EISDIR unless recursive.
-      unlinkSync(link)
-    }
-  }
-  try {
-    symlinkSync(target, link, 'junction')
-  } catch (error) {
-    // Concurrent launches heal the same fallback; losing the race to a
-    // process writing the identical link is success, anything else is not.
-    // The window between the lstat miss above and this write cannot be
-    // staged deterministically from the public API.
-    /* v8 ignore next 4 */
-    if ((error as NodeJS.ErrnoException).code !== 'EEXIST'
-      || !lstatSync(link).isSymbolicLink() || !symlinkPointsTo(link, target)) {
-      throw error
-    }
-  }
-}
-
-/** Add one profile-owned fallback link without replacing a pnpm-managed entry. */
-function ensureProfileSymlink(link: string, target: string): void {
-  try {
-    lstatSync(link)
-    return
-  } catch (error) {
-    /* v8 ignore next -- a non-ENOENT lstat failure requires a host filesystem fault */
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-  }
-  ensureSymlink(link, target)
-}
-
-/** Package names represented by owned symlinks below one fallback node_modules. */
-function ownedPackageNames(modulesDir: string): string[] {
-  return readdirSync(modulesDir, { withFileTypes: true }).flatMap((entry) => {
-    if (entry.name.startsWith('@') && entry.isDirectory()) {
-      return readdirSync(join(modulesDir, entry.name), { withFileTypes: true })
-        .filter(child => child.isSymbolicLink())
-        .map(child => `${entry.name}/${child.name}`)
-    }
-    return entry.isSymbolicLink() ? [entry.name] : []
-  })
-}
-
-/** Remove an obsolete owned target and its profile projection when still connected. */
-function removeProfileSymlink(profileModulesDir: string, ownedModulesDir: string, packageName: string): void {
-  const ownedLink = join(ownedModulesDir, packageName)
-  const profileLink = join(profileModulesDir, packageName)
-  try {
-    if (lstatSync(profileLink).isSymbolicLink() && symlinkPointsTo(profileLink, ownedLink)) unlinkSync(profileLink)
-  } catch (error) {
-    /* v8 ignore next -- a non-ENOENT lstat failure requires a host filesystem fault */
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-  }
-  try {
-    unlinkSync(ownedLink)
-  } catch (error) {
-    /* v8 ignore next -- concurrent identical cleanup may remove the link first */
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-  }
-}
-
-interface ModuleProxyManifest {
-  name: string
-  version: string
-  private: true
-  type: 'module'
-  exports: Record<string, string>
-  dsh: { moduleFallback: { targets: Record<string, string> } }
-}
-
-interface ModuleProxyRecord {
-  version?: unknown
-  dsh?: { moduleFallback?: { targets?: unknown } }
-}
-
-/** Resolve one available explicit package export under Node ESM import conditions. */
-function packageEntryFromPackage(
-  packageName: string,
-  packageDir: string,
-  declared: ResolvePackageManifest['exports'],
-  subpath: string,
-): string | undefined {
-  let candidates: string[] | void
-  try {
-    candidates = resolvePackage({ name: packageName, exports: declared }, subpath)
-  } catch (error) {
-    if ((error as Error).message.startsWith('No known conditions for ')) return undefined
-    const specifier = subpath === '.' ? packageName : packageName + subpath.slice(1)
-    throw new Error(`dsh: cannot resolve ESM export ${specifier} from installed package ${packageName}`, { cause: error })
-  }
-  for (const candidate of candidates ?? []) {
-    const target = candidate
-    const entry = resolve(packageDir, target)
-    const relativeEntry = relative(packageDir, entry)
-    if (!target.startsWith('./') || /^\.\.(?:[\\/]|$)/u.test(relativeEntry)) {
-      throw new Error(`dsh: installed package ${packageName} export ${subpath} resolves outside its package: ${target}`)
-    }
-    if (existsSync(entry) && statSync(entry).isFile()) return pathToFileURL(entry).href
-  }
-  return undefined
-}
-
-/** Resolve every explicit ESM runtime export that an out-of-tree plugin can import. */
-function packageProxySource(
-  packageName: string,
-  packageDir: string,
-): { version: string; targets: Record<string, string> } {
-  const manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8')) as {
-    bin?: unknown
-    exports?: unknown
-    main?: unknown
-    types?: unknown
-    typings?: unknown
-    version?: unknown
-  }
-  if (typeof manifest.version !== 'string' || manifest.version.length === 0) {
-    throw new Error(`dsh: installed package ${packageName} must declare a non-empty version`)
-  }
-  const declared = manifest.exports
-  if (declared === undefined) {
-    const main = typeof manifest.main === 'string' && manifest.main.length > 0 ? manifest.main : undefined
-    const entry = join(packageDir, main ?? 'index')
-    try {
-      const resolved = createRequire(join(packageDir, 'package.json')).resolve(entry)
-      return { version: manifest.version, targets: { '.': pathToFileURL(resolved).href } }
-    } catch (error) {
-      if (main === undefined
-        && (manifest.bin !== undefined || manifest.types !== undefined || manifest.typings !== undefined)) {
-        return { version: manifest.version, targets: {} }
-      }
-      throw new Error(`dsh: installed package ${packageName} main entry is missing at ${entry}`, { cause: error })
-    }
-  }
-  const subpaths = declared !== null && typeof declared === 'object' && !Array.isArray(declared)
-    && Object.keys(declared).some(key => key.startsWith('.'))
-    ? Object.keys(declared).filter(key => key === '.' || (
-      key.startsWith('./') && !key.includes('*') && !key.endsWith('/') && key !== './package.json'
-    ))
-    : ['.']
-  const targets: Record<string, string> = {}
-  for (const subpath of subpaths) {
-    const target = packageEntryFromPackage(
-      packageName,
-      packageDir,
-      declared as ResolvePackageManifest['exports'],
-      subpath,
-    )
-    if (target !== undefined) targets[subpath] = target
-  }
-  return { version: manifest.version, targets }
-}
+/** Directory where the link backend of the dsh 0.1.5 releases projected bundle-carried packages into a profile. */
+const LINK_PROJECTION_DIR = '.dsh-module-fallback'
 
 /**
- * Materialize a real package proxy whose exports retain pkg's virtual module
- * URL. Files outside the executable cannot traverse a symlink into
- * `/snapshot`, while an ESM re-export can import that URL and preserves the
- * executable's single module instance for out-of-tree plugin peers.
+ * Remove the package projections a link-backend launch left in a profile.
+ * Only symlinks under the profile's `node_modules` whose target lies inside
+ * `<profile>/.dsh-module-fallback/node_modules` are unlinked, then that directory is removed;
+ * pnpm-installed packages and every other symlink stay. A profile without the directory is untouched.
+ * @param dir - the profile directory.
  */
-function ensureModuleProxy(
-  link: string,
-  packageName: string,
-  version: string,
-  targets: Record<string, string>,
-): void {
-  const proxyExports = Object.fromEntries(
-    Object.keys(targets).map((subpath, index) => [subpath, `./entry-${index}.js`]),
-  )
-  const manifest: ModuleProxyManifest = {
-    name: packageName,
-    version,
-    private: true,
-    type: 'module',
-    exports: proxyExports,
-    dsh: { moduleFallback: { targets } },
+export function removeLinkProjections(dir: string): void {
+  const owned = join(dir, LINK_PROJECTION_DIR)
+  if (!existsSync(owned)) return
+  const ownedModules = join(owned, 'node_modules')
+  for (const link of symlinksUnder(join(dir, 'node_modules'))) {
+    if (pointsInto(link, ownedModules)) unlinkSync(link)
   }
-  let stat
-  try {
-    stat = lstatSync(link)
-  } catch {
-    stat = undefined
-  }
-  if (stat?.isSymbolicLink()) {
-    unlinkSync(link)
-    stat = undefined
-  }
-  if (stat !== undefined) {
-    const existing = readModuleProxyRecord(link)
-    if (existing?.dsh?.moduleFallback?.targets === undefined) {
-      throw new Error(`dsh: ${link} exists and is not a dsh-managed module proxy; remove it so dsh can manage the installation fallback`)
+  rmSync(owned, { recursive: true, force: true })
+}
+
+/** Top-level and scoped entries under a node_modules directory that are symlinks or junctions. */
+function symlinksUnder(modules: string): string[] {
+  const links: string[] = []
+  if (!existsSync(modules)) return links
+  for (const entry of readdirSync(modules, { withFileTypes: true })) {
+    const path = join(modules, entry.name)
+    if (entry.isSymbolicLink()) {
+      links.push(path)
+    } else if (entry.name.startsWith('@') && entry.isDirectory()) {
+      for (const child of readdirSync(path, { withFileTypes: true })) {
+        if (child.isSymbolicLink()) links.push(join(path, child.name))
+      }
     }
-    if (existing.version === version
-      && JSON.stringify(existing.dsh.moduleFallback.targets) === JSON.stringify(targets)
-      && Object.keys(targets).every((_, index) => existsSync(join(link, `entry-${index}.js`)))) return
-    rmSync(link, { recursive: true })
   }
-  mkdirSync(link, { recursive: true })
-  writeFileSync(join(link, 'package.json'), JSON.stringify(manifest, undefined, 2) + '\n')
-  for (const [index, target] of Object.values(targets).entries()) {
-    const specifier = JSON.stringify(target)
-    writeFileSync(
-      join(link, `entry-${index}.js`),
-      `export * from ${specifier}\nimport * as target from ${specifier}\nexport default target.default\n`,
-    )
+  return links
+}
+
+/** Whether a symlink's target directory is `root` or lies below it. */
+function pointsInto(link: string, root: string): boolean {
+  try {
+    const target = resolve(dirname(link), readlinkSync(link))
+    const parent = realpathSync.native(dirname(target))
+    const rootPath = realpathSync.native(root)
+    return parent === rootPath || parent.startsWith(rootPath + sep)
+  } catch (error) {
+    // A target whose parent no longer exists cannot be one of the projections this launch owns.
+    /* v8 ignore next 2 -- a non-ENOENT realpath failure requires a host filesystem fault */
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false
+    /* v8 ignore next -- see the host-filesystem exception above */
+    throw error
   }
 }
 
-type ModuleFallbackEntry =
-  | { kind: 'symlink'; packageName: string; packageDir: string }
-  | { kind: 'proxy'; packageName: string; version: string; targets: Record<string, string> }
-
-/** Read one package manifest used while traversing a module-fallback dependency graph. */
-function readModuleFallbackManifest(anchor: string): ProfileManifest {
+/** Read one package manifest while traversing a dependency graph. */
+function readPackageManifest(anchor: string): ProfileManifest {
   return JSON.parse(readFileSync(anchor, 'utf8')) as ProfileManifest
 }
 
@@ -465,29 +257,32 @@ function profileDependencyNames(manifest: ProfileManifest): string[] {
   return [...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.peerDependencies ?? {})]
 }
 
-/** Resolve the installation generation that every profile must find through the fallback directory. */
-function resolveModuleFallbackEntries(
-  installAnchor: string, materialize = true, skippedBundles: ReadonlySet<string> = new Set(),
+/** Resolve the installation packages that the runtime resolver supplies to every profile. */
+function collectInstallationScopePackages(
+  installAnchor: string, skippedBundles: ReadonlySet<string>,
 ): {
-  entries: ModuleFallbackEntry[]
   packageNames: ReadonlySet<string>
   packageDirs: ReadonlyMap<string, string>
   declarers: ReadonlyMap<string, string>
   versions: ReadonlyMap<string, string | undefined>
 } {
-  const appManifest = readModuleFallbackManifest(installAnchor)
+  // Real declaring paths keep workspace symlinks under node_modules from disabling tsx path mappings.
+  const canonicalAnchor = join(realModuleDirectory(dirname(installAnchor)), basename(installAnchor))
+  const appManifest = readPackageManifest(canonicalAnchor)
   const links = new Map<string, string>()
   const declarers = new Map<string, string>()
   const versions = new Map<string, string | undefined>()
   /* v8 ignore next -- a real app manifest always declares its name */
   if (appManifest.name !== undefined) {
+    // The CLI derives the installation anchor from import.meta.url (already real) and the Desktop Host from its
+    // runtime directory (not a symlink); the directory is kept as given rather than canonicalized here.
     links.set(appManifest.name, dirname(installAnchor))
-    declarers.set(appManifest.name, installAnchor)
+    declarers.set(appManifest.name, canonicalAnchor)
     versions.set(appManifest.name, appManifest.version)
   }
   // BFS over the resolvable dependency graph; the visited set is the link
   // map itself (first resolution wins, matching Node's own nearest-wins).
-  const queue: { anchor: string; manifest: ProfileManifest }[] = [{ anchor: installAnchor, manifest: appManifest }]
+  const queue: { anchor: string; manifest: ProfileManifest }[] = [{ anchor: canonicalAnchor, manifest: appManifest }]
   for (let next = queue.shift(); next !== undefined; next = queue.shift()) {
     // Peer dependencies participate: Service Definition packages (dsh-subprocess,
     // dsh-compaction, ...) are peers of their implementations, never plain
@@ -499,10 +294,10 @@ function resolveModuleFallbackEntries(
       // A declared-but-uninstalled dependency cannot be a loader-visible
       // plugin; skip it rather than fail the whole boot.
       if (dir === undefined) continue
-      const manifestPath = join(dir, 'package.json')
+      const manifestPath = join(realModuleDirectory(dir), 'package.json')
       let manifest: ProfileManifest
       try {
-        manifest = skippedBundles.has(dep) ? readProfileManifest('dsh', dir) : readModuleFallbackManifest(manifestPath)
+        manifest = skippedBundles.has(dep) ? readProfileManifest('dsh', dir) : readPackageManifest(manifestPath)
       } catch (error) {
         if (!skippedBundles.has(dep)) throw error
         continue
@@ -513,90 +308,41 @@ function resolveModuleFallbackEntries(
       queue.push({ anchor: manifestPath, manifest })
     }
   }
-  const entries = !materialize
-    ? []
-    : !isPackagedExecutable()
-      ? [...links].map(([packageName, packageDir]) => ({ kind: 'symlink' as const, packageName, packageDir }))
-      : [...links].flatMap(([packageName, packageDir]) => {
-        const source = packageProxySource(packageName, packageDir)
-        return Object.keys(source.targets).length === 0
-          ? []
-          : [{ kind: 'proxy' as const, packageName, version: source.version, targets: source.targets }]
-      })
-  return { entries, packageNames: new Set(links.keys()), packageDirs: links, declarers, versions }
+  return { packageNames: new Set(links.keys()), packageDirs: links, declarers, versions }
 }
 
-/** Return whether one existing fallback entry already matches its resolved installation generation. */
-function moduleFallbackEntryCurrent(modulesDir: string, entry: ModuleFallbackEntry): boolean {
-  const link = join(modulesDir, entry.packageName)
-  try {
-    const stat = lstatSync(link)
-    if (entry.kind === 'symlink') {
-      return stat.isSymbolicLink() && readlinkSync(link) === entry.packageDir
-    }
-    if (!stat.isDirectory()) return false
-    const existing = readModuleProxyRecord(link)
-    return existing?.version === entry.version
-      && JSON.stringify(existing.dsh?.moduleFallback?.targets) === JSON.stringify(entry.targets)
-      && Object.keys(entry.targets).every((_, index) => existsSync(join(link, `entry-${index}.js`)))
-  } catch {
-    return false
-  }
-}
-
-/** Return whether every required fallback entry is already ready for this installation. */
-function moduleFallbackCurrent(modulesDir: string, entries: readonly ModuleFallbackEntry[]): boolean {
-  return entries.every(entry => moduleFallbackEntryCurrent(modulesDir, entry))
-}
-
-/** Inputs for {@link healProfilesModuleFallback}. */
-export interface ProfileModuleFallbackOptions {
+/** Inputs for {@link createRuntimeResolution}. */
+export interface RuntimeResolutionOptions {
   /** Absolute package.json path of the running dsh installation. */
   installAnchor: string
   /** Loaded profile whose selected bundles may carry profile-local plugins. */
   profile?: Profile
   /** Harness home; defaults to {@link resolveDshHome}. */
   home?: string
-  /** Whether to materialize the computed generation; defaults to true. */
-  materialize?: boolean
 }
 
 /**
- * Maintain module fallbacks for one profile launch. The shared
- * `$DSH_HOME/profiles/node_modules` mirrors the dsh installation dependency
- * closure. Plain Node writes symlinks; a packaged executable writes ESM
- * proxies under a cross-process lock because operating-system links cannot
- * enter pkg's virtual filesystem. Missing packages carried only by selected
- * bundles are linked through a profile-owned directory into that profile's
- * `node_modules`; pnpm-managed entries remain authoritative, and another
- * profile's links cannot change its resolution.
+ * Compute the runtime resolution without writing module-resolution files.
  * @param options - installation anchor, optional loaded profile, and Harness home.
- * @returns the computed fallback generation after optional materialization.
+ * @returns the complete immutable runtime resolution.
  */
-export async function healProfilesModuleFallback(
-  options: ProfileModuleFallbackOptions,
-): Promise<ProfileResolutionGeneration> {
-  const { installAnchor, profile, home = resolveDshHome(), materialize = true } = options
+export async function createRuntimeResolution(
+  options: RuntimeResolutionOptions,
+): Promise<RuntimeResolution> {
+  const { installAnchor, profile, home = resolveDshHome() } = options
   const profilesDir = join(home, PROFILES_DIR)
-  const modulesDir = join(profilesDir, 'node_modules')
-  if (materialize) mkdirSync(modulesDir, { recursive: true })
   const manifest = readOptionalProfileManifest(profile)
-  const { entries, packageNames, packageDirs, declarers, versions } = resolveModuleFallbackEntries(
-    installAnchor, materialize, skippedProfileBundles(profile, manifest),
+  const { packageNames, packageDirs, declarers, versions } = collectInstallationScopePackages(
+    installAnchor, skippedProfileBundles(profile, manifest),
   )
-  if (materialize && !moduleFallbackCurrent(modulesDir, entries)) {
-    await withFileLock(modulesDir, () => {
-      if (!moduleFallbackCurrent(modulesDir, entries)) healProfilesModuleFallbackLocked(entries, modulesDir)
-      return Promise.resolve()
-    })
-  }
   const profileDeclarers = new Map<string, string>()
   const profileVersions = new Map<string, string | undefined>()
   const localPackageNames = profile === undefined ? [] : installedProfilePackageNames(profile, manifest)
   const profilePackages: ReadonlyMap<string, string> = profile === undefined
     ? new Map<string, string>()
-    : healProfileModuleFallback(profile, packageNames, materialize, profileDeclarers, profileVersions)
-  return Object.freeze({
+    : collectProfileScopePackages(profile, packageNames, profileDeclarers, profileVersions)
+  // The Promise return type is the pre-stable API; construction has no asynchronous step.
+  return await Promise.resolve(Object.freeze({
     profilesDir,
     profileDir: profile?.dir,
     localPackageNames: Object.freeze(localPackageNames),
@@ -610,14 +356,14 @@ export async function healProfilesModuleFallback(
         declarer: profileDeclarers.get(name) as string, scope: 'profile' as const,
       })),
     ]),
-  })
+  }))
 }
 
 /** Synthetic profiles used by direct callers may have no on-disk manifest. */
 function readOptionalProfileManifest(profile: Profile | undefined): ProfileManifest | undefined {
   if (profile === undefined) return undefined
   try {
-    return readModuleFallbackManifest(join(profile.dir, 'package.json'))
+    return readPackageManifest(join(profile.dir, 'package.json'))
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined
     throw error
@@ -634,67 +380,13 @@ function skippedProfileBundles(profile: Profile | undefined, manifest: ProfileMa
 /** Return installed direct dependencies that Node resolves before profile fallback. */
 function installedProfilePackageNames(profile: Profile, manifest: ProfileManifest | undefined): string[] {
   if (manifest === undefined) return []
-  return profileDependencyNames(manifest).filter((name) => {
-    const candidate = join(profile.dir, 'node_modules', name)
-    if (!existsSync(join(candidate, 'package.json'))) return false
-    return !isProfileModuleFallbackLink(profile.dir, name)
-  })
-}
-
-/**
- * Compute a profile resolution generation without materializing links or proxies.
- * @param options - installation anchor, profile, and optional Harness home.
- * @returns the complete immutable generation.
- */
-export function createProfileResolutionGeneration(
-  options: Omit<ProfileModuleFallbackOptions, 'materialize'>,
-): Promise<ProfileResolutionGeneration> {
-  return healProfilesModuleFallback({ ...options, materialize: false })
-}
-
-/**
- * Supply an application-owned profile with filesystem packages from its installation and selected bundles.
- * All fallback links belong to the profile; no shared Harness-home directory is written.
- * Existing pnpm-managed packages remain authoritative. The caller serializes profile mutations.
- * @param options - owning installation package.json and the loaded application profile.
- */
-export function healIsolatedProfileModuleFallback(options: { installAnchor: string; profile: Profile }): void {
-  const installationLinks = resolveModuleFallbackEntries(
-    options.installAnchor, false, skippedProfileBundles(options.profile, readOptionalProfileManifest(options.profile)),
-  ).packageDirs
-  healProfileModuleFallback(options.profile, new Set(installationLinks.keys()), true, undefined, undefined, installationLinks)
-}
-
-/**
- * Detach this profile's fallback links before a package-manager mutation.
- * Installed packages and links replaced by pnpm remain untouched; the next profile launch restores fallbacks.
- * @param profileDir - profile directory whose package mutation is serialized by the caller.
- */
-export function unlinkProfileModuleFallback(profileDir: string): void {
-  const ownedModulesDir = join(profileDir, PROFILE_MODULE_FALLBACK_DIR, 'node_modules')
-  if (!existsSync(ownedModulesDir)) return
-  for (const name of ownedPackageNames(ownedModulesDir)) {
-    removeProfileSymlink(join(profileDir, 'node_modules'), ownedModulesDir, name)
-  }
-}
-
-/** Heal one module-fallback generation while the cross-process writer lock is held. */
-function healProfilesModuleFallbackLocked(entries: readonly ModuleFallbackEntry[], modulesDir: string): void {
-  for (const entry of entries) {
-    const link = join(modulesDir, entry.packageName)
-    mkdirSync(dirname(link), { recursive: true })
-    if (entry.kind === 'proxy') {
-      ensureModuleProxy(link, entry.packageName, entry.version, entry.targets)
-    } else {
-      ensureSymlink(link, entry.packageDir)
-    }
-  }
+  return profileDependencyNames(manifest)
+    .filter(name => existsSync(join(profile.dir, 'node_modules', name, 'package.json')))
 }
 
 /** Collect the first resolvable package directory for each dependency name. */
 function dependencyClosure(
   anchors: readonly string[], reserved: ReadonlySet<string>,
-  exclude: (candidate: string, packageName: string) => boolean,
   declarers?: Map<string, string>,
   versions?: Map<string, string | undefined>,
 ): Map<string, string> {
@@ -702,7 +394,7 @@ function dependencyClosure(
   const visited = new Set(reserved)
   for (const anchor of anchors) {
     const canonicalAnchor = join(realModuleDirectory(dirname(anchor)), basename(anchor))
-    const manifest = readModuleFallbackManifest(canonicalAnchor)
+    const manifest = readPackageManifest(canonicalAnchor)
     /* v8 ignore next -- an installable package manifest always declares its name */
     if (manifest.name === undefined) continue
     if (!visited.has(manifest.name)) {
@@ -717,14 +409,14 @@ function dependencyClosure(
       /* v8 ignore next -- an installable package manifest always declares dependencies or peers */
       for (const dep of profileDependencyNames(next.manifest)) {
         if (visited.has(dep)) continue
-        const dir = packageDirFromAnchor(next.anchor, dep, exclude)
+        const dir = packageDirFromAnchor(next.anchor, dep)
         // A declared-but-uninstalled dependency cannot be loader-visible.
         if (dir === undefined) continue
         visited.add(dep)
         links.set(dep, dir)
         declarers?.set(dep, next.anchor)
-        const manifestPath = join(dir, 'package.json')
-        const dependencyManifest = readModuleFallbackManifest(manifestPath)
+        const manifestPath = join(realModuleDirectory(dir), 'package.json')
+        const dependencyManifest = readPackageManifest(manifestPath)
         versions?.set(dep, dependencyManifest.version)
         queue.push({ anchor: manifestPath, manifest: dependencyManifest })
       }
@@ -733,51 +425,18 @@ function dependencyClosure(
   return links
 }
 
-/** Reconcile packages carried only by selected bundles into one profile. */
-function healProfileModuleFallback(
-  profile: Profile, installationPackageNames: ReadonlySet<string>, materialize = true,
+/** Collect packages carried by the profile's selected bundles that the installation does not supply. */
+function collectProfileScopePackages(
+  profile: Profile, installationPackageNames: ReadonlySet<string>,
   declarers?: Map<string, string>,
   versions?: Map<string, string | undefined>,
-  installationLinks: ReadonlyMap<string, string> = new Map(),
 ): Map<string, string> {
-  const profileModulesDir = join(profile.dir, 'node_modules')
-  const ownedModulesDir = join(profile.dir, PROFILE_MODULE_FALLBACK_DIR, 'node_modules')
-  if (materialize) {
-    mkdirSync(profileModulesDir, { recursive: true })
-    mkdirSync(ownedModulesDir, { recursive: true })
-  }
   const bundleAnchors = profile.layers
     .filter(layer => !installationPackageNames.has(layer.packageName))
     .map(layer => join(layer.packageDir, 'package.json'))
-  const bundleLinks = dependencyClosure(bundleAnchors, installationPackageNames, (candidate, packageName) => {
-    const profileLink = join(profileModulesDir, packageName)
-    if (canonicalLinkPath(candidate) !== canonicalLinkPath(profileLink)) return false
-    try {
-      return lstatSync(profileLink).isSymbolicLink()
-        && symlinkPointsTo(profileLink, join(ownedModulesDir, packageName))
-    } catch (error) {
-      // A concurrent cleanup may remove the projection after package discovery.
-      /* v8 ignore next 2 -- a non-ENOENT lstat failure requires a host filesystem fault */
-      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return true
-      /* v8 ignore next -- see the host-filesystem exception above */
-      throw error
-    }
-  }, declarers, versions)
+  const bundleLinks = dependencyClosure(bundleAnchors, installationPackageNames, declarers, versions)
   for (const layer of profile.layers) bundleLinks.delete(layer.packageName)
-  const links = new Map([...installationLinks, ...bundleLinks])
-  if (!materialize) return links
-  for (const packageName of ownedPackageNames(ownedModulesDir)) {
-    if (!links.has(packageName)) removeProfileSymlink(profileModulesDir, ownedModulesDir, packageName)
-  }
-  for (const [packageName, target] of links) {
-    const ownedLink = join(ownedModulesDir, packageName)
-    mkdirSync(dirname(ownedLink), { recursive: true })
-    ensureSymlink(ownedLink, target)
-    const profileLink = join(profileModulesDir, packageName)
-    mkdirSync(dirname(profileLink), { recursive: true })
-    ensureProfileSymlink(profileLink, ownedLink)
-  }
-  return links
+  return bundleLinks
 }
 
 /**
@@ -849,15 +508,12 @@ function normalizeShippedProfile(name: string, dir: string, manifest: ProfileMan
  * matches what the Loader would import from the same anchor, and
  * `existsSync` follows the symlinks pnpm's isolated layout uses.
  */
-function packageDirFromAnchor(
-  anchor: string, packageName: string,
-  exclude: (candidate: string, packageName: string) => boolean = () => false,
-): string | undefined {
+function packageDirFromAnchor(anchor: string, packageName: string): string | undefined {
   // resolve.paths returns null only for builtins, which no bundle name is.
   /* v8 ignore next */
   for (const searchPath of createRequire(anchor).resolve.paths(packageName) ?? []) {
     const candidate = join(searchPath, packageName)
-    if (existsSync(join(candidate, 'package.json')) && !exclude(candidate, packageName)) return candidate
+    if (existsSync(join(candidate, 'package.json'))) return candidate
   }
   return undefined
 }
@@ -955,6 +611,7 @@ export function loadProfile(
     }
     initProfile(dir, template.bundles)
   }
+  removeLinkProjections(dir)
   normalizeShippedProfile(name, dir, readProfileManifest(binName, dir))
   return loadProfileDirectory(binName, dir, installAnchor, options)
 }
diff --git a/packages/boot/app-boot/tests/profile-resolution-service.spec.ts b/packages/boot/app-boot/tests/profile-resolution-service.spec.ts
index 62ce14795a..5d7f34b876 100644
--- a/packages/boot/app-boot/tests/profile-resolution-service.spec.ts
+++ b/packages/boot/app-boot/tests/profile-resolution-service.spec.ts
@@ -1,6 +1,6 @@
-/** Package metadata queries share the active profile resolution generation. */
+/** Package metadata queries share the active runtime resolution. */
 
-import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
@@ -9,7 +9,7 @@ import { getEnvironmentData } from 'node:worker_threads'
 import { Context } from '@deepseek-ai/cordis'
 import { afterEach, describe, expect, it } from 'vitest'
 import { PluginPackages } from '../src/profile-resolution/service.ts'
-import type { ProfileResolutionGeneration } from '../src/profile.ts'
+import type { RuntimeResolution } from '../src/profile.ts'
 
 const roots: string[] = []
 const contexts: Context[] = []
@@ -36,9 +36,9 @@ function pkg(dir: string, version: string, name = 'metadata-lib'): string {
   return join(dir, 'package.json')
 }
 
-function generation(
+function resolution(
   profilesDir: string, profileDir: string, packageDir: string, declarer: string, version: string,
-): ProfileResolutionGeneration {
+): RuntimeResolution {
   return {
     profilesDir,
     profileDir,
@@ -48,7 +48,7 @@ function generation(
 }
 
 describe('profile package metadata service', () => {
-  it('resolves module URLs and package metadata through the current generation', async () => {
+  it('resolves module URLs and package metadata through the current resolution', async () => {
     const root = mkdtempSync(join(tmpdir(), 'dsh-profile-package-service-'))
     roots.push(root)
     const profilesDir = join(root, 'profiles')
@@ -62,7 +62,7 @@ describe('profile package metadata service', () => {
     contexts.push(ctx)
     ctx.baseUrl = pathToFileURL(profileDir).href + '/'
     await ctx.plugin(PluginPackages, {
-      generation: generation(profilesDir, profileDir, first, firstAnchor, '1.0.0'),
+      resolution: resolution(profilesDir, profileDir, first, firstAnchor, '1.0.0'),
     })
 
     expect(ctx.pluginPackages.packageOf('metadata-lib/private', parentURL)).toMatchObject({
@@ -126,62 +126,33 @@ describe('profile package metadata service', () => {
     const ctx = new Context()
     contexts.push(ctx)
     await ctx.plugin(PluginPackages, {
-      generation: generation(profilesDir, profileDir, missing, join(root, 'owner.json'), '1.0.0'),
+      resolution: resolution(profilesDir, profileDir, missing, join(root, 'owner.json'), '1.0.0'),
     })
     expect(ctx.pluginPackages.packageOf(
       'metadata-lib', pathToFileURL(join(profileDir, 'entry.mjs')).href,
     )).toBeUndefined()
   })
 
-  it('does not revive a stale disk fallback after the runtime generation misses', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'dsh-stale-package-service-'))
-    roots.push(root)
-    const profilesDir = join(root, 'profiles')
-    const profileDir = join(profilesDir, 'test')
-    pkg(join(profilesDir, 'node_modules', 'stale-metadata'), '0.9.0', 'stale-metadata')
-    const ctx = new Context()
-    contexts.push(ctx)
-    await ctx.plugin(PluginPackages, {
-      generation: { profilesDir, profileDir, localPackageNames: [], entries: [] },
-    })
-
-    expect(ctx.pluginPackages.packageOf(
-      'stale-metadata', pathToFileURL(join(profileDir, 'entry.mjs')).href,
-    )).toBeUndefined()
-  })
-
   it('publishes additive generations to the process and future Workers', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'dsh-package-service-generation-'))
+    const root = mkdtempSync(join(tmpdir(), 'dsh-package-service-resolution-'))
     roots.push(root)
     const profilesDir = join(root, 'profiles')
     const profileDir = join(profilesDir, 'test')
     const first = join(root, 'first')
     const firstAnchor = pkg(first, '1.0.0')
-    const initial = generation(profilesDir, profileDir, first, firstAnchor, '1.0.0')
-    mkdirSync(join(profilesDir, 'node_modules'), { recursive: true })
-    symlinkSync(
-      first,
-      join(profilesDir, 'node_modules', 'metadata-lib'),
-      process.platform === 'win32' ? 'junction' : 'dir',
-    )
+    const initial = resolution(profilesDir, profileDir, first, firstAnchor, '1.0.0')
     const key = '@deepseek-ai/dsh-app-boot/profile-resolution'
     const previous = getEnvironmentData(key)
     const ctx = new Context()
     contexts.push(ctx)
-    await ctx.plugin(PluginPackages, { generation: initial, behavior: 'verify' })
+    await ctx.plugin(PluginPackages, { resolution: initial })
     const initialWorkerData = getEnvironmentData(key) as {
-      generation: ProfileResolutionGeneration
-      behavior: string
+      resolution: RuntimeResolution
     }
-    expect(initialWorkerData).toEqual({ generation: initial, behavior: 'verify' })
+    expect(initialWorkerData).toEqual({ resolution: initial })
 
     const added = join(root, 'added')
     const addedAnchor = pkg(added, '2.0.0', 'added-metadata')
-    symlinkSync(
-      added,
-      join(profilesDir, 'node_modules', 'added-metadata'),
-      process.platform === 'win32' ? 'junction' : 'dir',
-    )
     const next = {
       ...initial,
       entries: [...initial.entries, {
@@ -191,8 +162,7 @@ describe('profile package metadata service', () => {
     }
     ctx.pluginPackages.replace(next)
     expect(getEnvironmentData(key)).toEqual({
-      generation: next,
-      behavior: 'verify',
+      resolution: next,
     })
     expect(ctx.pluginPackages.packageOf(
       'added-metadata', pathToFileURL(join(profileDir, 'entry.mjs')).href,
diff --git a/packages/boot/app-boot/tests/profile-resolution-worker-bootstrap.spec.ts b/packages/boot/app-boot/tests/profile-resolution-worker-bootstrap.spec.ts
index a0ab5a7616..205e6a7e57 100644
--- a/packages/boot/app-boot/tests/profile-resolution-worker-bootstrap.spec.ts
+++ b/packages/boot/app-boot/tests/profile-resolution-worker-bootstrap.spec.ts
@@ -1,12 +1,11 @@
-/** Worker bootstrap installs only the generation inherited from its parent. */
+/** Worker bootstrap installs only the resolution inherited from its parent. */
 
 import { beforeEach, expect, it, vi } from 'vitest'
-import type { ProfileResolutionGeneration } from '../src/profile.ts'
+import type { RuntimeResolution } from '../src/profile.ts'
 
 const harness = vi.hoisted(() => ({
   data: undefined as {
-    generation: ProfileResolutionGeneration
-    behavior: 'enforce' | 'verify'
+    resolution: RuntimeResolution
   } | undefined,
   install: vi.fn(),
 }))
@@ -16,7 +15,7 @@ vi.mock('node:worker_threads', () => ({
 }))
 
 vi.mock('../src/profile-resolution/resolver.ts', () => ({
-  installProfileResolution: harness.install,
+  installRuntimeInterception: harness.install,
 }))
 
 beforeEach(() => {
@@ -30,14 +29,14 @@ it('does nothing without inherited profile resolution data', async () => {
   expect(harness.install).not.toHaveBeenCalled()
 })
 
-it('installs the inherited generation and behavior', async () => {
-  const generation: ProfileResolutionGeneration = {
+it('installs the inherited resolution', async () => {
+  const resolution: RuntimeResolution = {
     profilesDir: '/profiles',
     profileDir: '/profiles/test',
     localPackageNames: [],
     entries: [],
   }
-  harness.data = { generation, behavior: 'verify' }
+  harness.data = { resolution }
   await import('../src/profile-resolution/worker-bootstrap.ts')
-  expect(harness.install).toHaveBeenCalledWith(generation, 'verify')
+  expect(harness.install).toHaveBeenCalledWith(resolution)
 })
diff --git a/packages/boot/app-boot/tests/profile-resolution.spec.ts b/packages/boot/app-boot/tests/profile-resolution.spec.ts
index c47fd2eeaf..7ce3528c8b 100644
--- a/packages/boot/app-boot/tests/profile-resolution.spec.ts
+++ b/packages/boot/app-boot/tests/profile-resolution.spec.ts
@@ -1,4 +1,4 @@
-/** Runtime profile resolution uses one eager generation for ESM and CommonJS. */
+/** Runtime profile resolution uses one eager resolution for ESM and CommonJS. */
 
 import {
   existsSync,
@@ -17,19 +17,19 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { getEnvironmentData } from 'node:worker_threads'
 import { afterEach, describe, expect, it } from 'vitest'
 import {
-  installProfileResolution,
+  installRuntimeInterception,
   registerWorkerResolution,
-  type ProfileResolutionRegistration,
+  type RuntimeInterception,
 } from '../src/profile-resolution/resolver.ts'
 import {
-  createProfileResolutionGeneration,
-  healProfilesModuleFallback,
+  createRuntimeResolution,
+  loadProfile,
   type Profile,
-  type ProfileResolutionGeneration,
+  type RuntimeResolution,
 } from '../src/profile.ts'
 
 const roots: string[] = []
-const registrations: ProfileResolutionRegistration[] = []
+const registrations: RuntimeInterception[] = []
 
 afterEach(() => {
   for (const registration of registrations.splice(0).reverse()) registration.dispose()
@@ -133,29 +133,31 @@ function thrownError(callback: () => unknown): Error & {
   throw new Error('expected callback to throw')
 }
 
-function fixture(name = 'resolution-lib'): {
+function fixture(name = '@deepseek-ai/dsh-core'): {
   root: string
   installAnchor: string
   installed: string
   profile: Profile
 } {
-  // macOS exposes tmpdir through /var while Node returns resolved module paths through /private/var.
-  const root = realpathSync(mkdtempSync(join(tmpdir(), 'dsh-profile-generation-')))
+  // root plays $DSH_HOME; the running dsh lives in a global install outside the profiles tree.
+  // Node reports resolved module paths through the native realpath: /private/var for a macOS tmpdir under /var,
+  // and the long directory name for a Windows tmpdir spelled with an 8.3 short name.
+  const root = realpathSync.native(mkdtempSync(join(tmpdir(), 'dsh-profile-resolution-')))
   roots.push(root)
-  const installDir = join(root, 'install')
+  const installDir = join(root, 'global', 'node_modules', '@deepseek-ai', 'dsh')
   const installed = join(installDir, 'node_modules', name)
-  const installAnchor = pkg(installDir, 'test-app', 0, { [name]: '*' })
+  const installAnchor = pkg(installDir, '@deepseek-ai/dsh', 0, { [name]: '*' })
   pkg(installed, name, 1)
-  const profileDir = join(root, 'profiles', 'test')
+  const profileDir = join(root, 'profiles', 'web')
   file(join(profileDir, 'package.json'), JSON.stringify({
-    name: 'test-profile', private: true, dependencies: { 'missing-local': '*' },
+    name: 'dsh-profile-web', private: true, dependencies: { 'missing-local': '*' },
   }))
   return {
     root,
     installAnchor,
     installed,
     profile: {
-      name: 'test',
+      name: 'web',
       dir: profileDir,
       layers: [],
       patchPath: join(profileDir, 'cordis.patch.yml'),
@@ -164,65 +166,142 @@ function fixture(name = 'resolution-lib'): {
   }
 }
 
-async function generationOf(f: ReturnType<typeof fixture>): Promise<ProfileResolutionGeneration> {
-  return await healProfilesModuleFallback({
+async function resolutionOf(f: ReturnType<typeof fixture>): Promise<RuntimeResolution> {
+  return await createRuntimeResolution({
     installAnchor: f.installAnchor,
     profile: f.profile,
     home: f.root,
-    materialize: false,
   })
 }
 
-describe('profile resolution generation', { concurrent: false }, () => {
-  it('computes the old fallback graph without materializing it', async () => {
+/**
+ * Ancestor node_modules layers of a profile importer, innermost first:
+ * private (plugin-private), profile (profile node_modules), shared
+ * (profiles/node_modules, the interception layer), home (Harness home).
+ */
+type LookupLayer = 'private' | 'profile' | 'shared' | 'home'
+const LOOKUP_LAYERS: readonly LookupLayer[] = ['private', 'profile', 'shared', 'home']
+const LOOKUP_MARKERS: Record<LookupLayer, number> = { private: 11, profile: 12, shared: 13, home: 14 }
+
+interface LookupCase {
+  title: string
+  importer: 'profile' | 'plugin'
+  kind: 'installation' | 'bundle' | 'unlisted'
+  layers: readonly LookupLayer[]
+  form: 'directory' | 'symlink'
+}
+
+/** Every combination of importer, package kind, present layers, and on-disk form of the profile and shared layers. */
+function lookupMatrix(): LookupCase[] {
+  const cases: LookupCase[] = []
+  for (const importer of ['profile', 'plugin'] as const) {
+    const available = importer === 'plugin' ? LOOKUP_LAYERS : LOOKUP_LAYERS.filter(layer => layer !== 'private')
+    for (let mask = 0; mask < 1 << available.length; mask++) {
+      const layers = available.filter((_, index) => (mask & (1 << index)) !== 0)
+      const forms = layers.some(layer => layer === 'profile' || layer === 'shared')
+        ? ['directory', 'symlink'] as const
+        : ['directory'] as const
+      for (const kind of ['installation', 'bundle', 'unlisted'] as const) {
+        for (const form of forms) {
+          cases.push({
+            title: `resolves ${kind} package from ${importer} importer with [${layers.join(', ')}] as ${form}`,
+            importer, kind, layers, form,
+          })
+        }
+      }
+    }
+  }
+  return cases
+}
+
+/** The lookup order: profile-internal layers, then the resolution at the interception layer, then the remaining ancestors. */
+function lookupWinner(matrixCase: LookupCase): LookupLayer | 'interception' | 'missing' {
+  if (matrixCase.importer === 'plugin' && matrixCase.layers.includes('private')) return 'private'
+  if (matrixCase.layers.includes('profile')) return 'profile'
+  if (matrixCase.kind !== 'unlisted') return 'interception'
+  if (matrixCase.layers.includes('shared')) return 'shared'
+  if (matrixCase.layers.includes('home')) return 'home'
+  return 'missing'
+}
+
+describe('runtime resolution', { concurrent: false }, () => {
+  it('computes an immutable runtime resolution without writing profile packages', async () => {
     const f = fixture()
-    const generation = await generationOf(f)
-    expect(generation.entries.find(entry => entry.name === 'resolution-lib')).toMatchObject({
+    const resolution = await resolutionOf(f)
+    expect(resolution.entries.find(entry => entry.name === '@deepseek-ai/dsh-core')).toMatchObject({
       packageDir: f.installed,
       version: '1.0.0',
       declarer: f.installAnchor,
       scope: 'installation',
     })
-    expect(existsSync(join(generation.profilesDir, 'node_modules'))).toBe(false)
-    expect(existsSync(join(f.profile.dir, '.dsh-module-fallback'))).toBe(false)
-    expect(Object.isFrozen(generation)).toBe(true)
-    expect(Object.isFrozen(generation.entries)).toBe(true)
-    expect(generation.entries.every(Object.isFrozen)).toBe(true)
+    expect(existsSync(join(resolution.profilesDir, 'node_modules'))).toBe(false)
+    expect(existsSync(join(f.profile.dir, 'node_modules'))).toBe(false)
+    expect(Object.isFrozen(resolution)).toBe(true)
+    expect(Object.isFrozen(resolution.entries)).toBe(true)
+    expect(resolution.entries.every(Object.isFrozen)).toBe(true)
 
-    const installationOnly = await createProfileResolutionGeneration({
+    const installationOnly = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       home: join(f.root, 'installation-only-home'),
     })
     expect(installationOnly.profileDir).toBeUndefined()
     expect(installationOnly.localPackageNames).toEqual([])
-    const registration = installProfileResolution(installationOnly)
+    const registration = installRuntimeInterception(installationOnly)
     registrations.push(registration)
-    expect(createRequire(join(installationOnly.profilesDir, 'entry.cjs'))('resolution-lib'))
+    expect(createRequire(join(installationOnly.profilesDir, 'entry.cjs'))('@deepseek-ai/dsh-core'))
       .toEqual({ marker: 1 })
   })
 
-  it('fails generation construction before writing when the profile manifest is malformed', async () => {
+  it('fails resolution construction before writing when the profile manifest is malformed', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), '{')
-    await expect(generationOf(f)).rejects.toThrow(SyntaxError)
+    await expect(resolutionOf(f)).rejects.toThrow(SyntaxError)
     expect(existsSync(join(f.root, 'profiles', 'node_modules'))).toBe(false)
   })
 
-  it('materializes exactly the package targets in the computed generation', async () => {
-    const f = fixture()
-    const computed = await generationOf(f)
-    const materialized = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    expect(materialized).toEqual(computed)
-    for (const entry of computed.entries) {
-      const projected = entry.scope === 'installation'
-        ? join(computed.profilesDir, 'node_modules', entry.name)
-        : join(f.profile.dir, '.dsh-module-fallback', 'node_modules', entry.name)
-      expect(realpathSync(projected)).toBe(realpathSync(entry.packageDir))
+  it.each([
+    ['installation', 'symlink'],
+    ['installation', 'directory'],
+    ['bundle', 'symlink'],
+    ['bundle', 'directory'],
+  ] as const)('canonicalizes transitive %s import anchors (%s packages)', async (origin, layout) => {
+    const f = fixture('bridge')
+    const linked = layout === 'symlink'
+    const workspace = join(f.root, 'workspace')
+    const bridge = linked ? join(workspace, 'bridge') : f.installed
+    const middle = linked ? join(workspace, 'middle') : join(bridge, 'node_modules', 'middle')
+    pkg(bridge, 'bridge', 1, { middle: '*' })
+    pkg(middle, 'middle', 2, { leaf: '*' })
+    const logicalLeaf = join(bridge, 'node_modules', 'leaf')
+    const workspaceLeaf = join(workspace, 'node_modules', 'leaf')
+    pkg(logicalLeaf, 'leaf', 1)
+    pkg(workspaceLeaf, 'leaf', 2)
+    const installAnchor = linked ? join(f.root, 'install-link', 'package.json') : f.installAnchor
+    if (linked) {
+      rmSync(f.installed, { recursive: true })
+      symlinkSync(bridge, f.installed, 'junction')
+      symlinkSync(middle, join(bridge, 'node_modules', 'middle'), 'junction')
+      symlinkSync(dirname(f.installAnchor), dirname(installAnchor), 'junction')
     }
+    if (origin === 'bundle') {
+      pkg(dirname(f.installAnchor), '@deepseek-ai/dsh', 0)
+      f.profile.layers.push({
+        packageName: 'bridge', packageDir: f.installed,
+        patchPath: join(f.installed, 'cordis.patch.yml'), patches: [],
+      })
+    }
+    expect(createRequire(join(bridge, 'node_modules', 'middle', 'package.json'))('leaf')).toEqual({ marker: 1 })
+    const resolution = await createRuntimeResolution({
+      installAnchor, profile: f.profile, home: f.root,
+    })
+    expect(resolution.entries.find(entry => entry.name === '@deepseek-ai/dsh')?.declarer).toBe(f.installAnchor)
+    expect(resolution.entries.find(entry => entry.name === 'middle')?.declarer)
+      .toBe(join(bridge, 'package.json'))
+    expect(resolution.entries.find(entry => entry.name === 'leaf')).toMatchObject({
+      packageDir: linked ? workspaceLeaf : logicalLeaf,
+      declarer: join(middle, 'package.json'),
+      version: linked ? '2.0.0' : '1.0.0',
+    })
   })
 
   it('keeps each earlier root complete before considering a later root', async () => {
@@ -255,16 +334,16 @@ describe('profile resolution generation', { concurrent: false }, () => {
       patches: [],
     })
 
-    const generation = await generationOf(f)
-    expect(generation.entries.find(entry => entry.name === 'ordered-choice')).toMatchObject({
+    const resolution = await resolutionOf(f)
+    expect(resolution.entries.find(entry => entry.name === 'ordered-choice')).toMatchObject({
       packageDir: installationChoice,
       scope: 'installation',
     })
-    const bundleChoice = generation.entries.find(entry => entry.name === 'bundle-choice')
-    if (bundleChoice === undefined) throw new Error('generation omitted bundle-choice')
+    const bundleChoice = resolution.entries.find(entry => entry.name === 'bundle-choice')
+    if (bundleChoice === undefined) throw new Error('resolution omitted bundle-choice')
     expect(bundleChoice).toMatchObject({ scope: 'profile' })
     expect(realpathSync.native(bundleChoice.packageDir)).toBe(realpathSync.native(firstBundleChoice))
-    expect(generation.entries.find(entry => entry.name === 'peer-choice')).toMatchObject({
+    expect(resolution.entries.find(entry => entry.name === 'peer-choice')).toMatchObject({
       packageDir: peerChoice,
       scope: 'installation',
     })
@@ -272,28 +351,28 @@ describe('profile resolution generation', { concurrent: false }, () => {
 
   it('routes ESM and CommonJS through the same installation entry', async () => {
     const f = fixture()
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require('resolution-lib')).toEqual({ marker: 1 })
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
+    expect(require('@deepseek-ai/dsh-core')).toEqual({ marker: 1 })
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(join(f.installed, 'index.cjs'))
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
-    expect(resolveFrom('resolution-lib', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    expect(resolveFrom('resolution-lib', parent, { type: 'javascript' }))
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent, { type: 'javascript' }))
       .toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    expect(resolveFrom('resolution-lib', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    expect(import.meta.resolve('resolution-lib', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    expect(await importFrom('resolution-lib', parent)).toMatchObject({ marker: 1 })
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
+    expect(import.meta.resolve('@deepseek-ai/dsh-core', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
+    expect(await importFrom('@deepseek-ai/dsh-core', parent)).toMatchObject({ marker: 1 })
   })
 
   it('routes a scoped CommonJS package through its containing node_modules directory', async () => {
-    const f = fixture('@scope/resolution-lib')
-    const registration = installProfileResolution(await generationOf(f))
+    const f = fixture('@scope/tools')
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
 
-    expect(require('@scope/resolution-lib')).toEqual({ marker: 1 })
-    expect(require.resolve('@scope/resolution-lib')).toBe(join(f.installed, 'index.cjs'))
+    expect(require('@scope/tools')).toEqual({ marker: 1 })
+    expect(require.resolve('@scope/tools')).toBe(join(f.installed, 'index.cjs'))
   })
 
   it('routes a CommonJS npm alias through its declaring package', async () => {
@@ -302,115 +381,103 @@ describe('profile resolution generation', { concurrent: false }, () => {
     pkg(target, 'real-lib', 5)
     rmSync(f.installed, { recursive: true })
     symlinkSync(target, f.installed, process.platform === 'win32' ? 'junction' : 'dir')
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
 
     expect(createRequire(join(f.profile.dir, 'entry.cjs'))('aliased-lib')).toEqual({ marker: 5 })
   })
 
-  it('verifies a materialized scoped CommonJS package against the generation', async () => {
-    const f = fixture('@scope/resolution-lib')
-    const generation = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const registration = installProfileResolution(generation, 'verify')
-    registrations.push(registration)
-
-    expect(createRequire(join(f.profile.dir, 'dual-entry.cjs')).resolve('@scope/resolution-lib'))
-      .toBe(realpathSync(join(f.installed, 'index.cjs')))
-  })
-
-  it('routes an application-owned profile outside the shared profiles directory', async () => {
+  it('intercepts directly above an application-owned profile outside the shared profiles directory', async () => {
     const f = fixture()
     const profileDir = join(f.root, 'application-profile')
     file(join(profileDir, 'package.json'), JSON.stringify({ name: 'application-profile', private: true }))
+    // The first ancestor node_modules above the profile directory is the interception layer.
+    pkg(join(f.root, 'node_modules', '@deepseek-ai/dsh-core'), '@deepseek-ai/dsh-core', 2)
     const profile = {
       ...f.profile,
       dir: profileDir,
       patchPath: join(profileDir, 'cordis.patch.yml'),
     }
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile,
       home: f.root,
-      materialize: false,
     })
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
     const require = createRequire(join(profileDir, 'entry.cjs'))
-    expect(require('resolution-lib')).toEqual({ marker: 1 })
+    expect(require('@deepseek-ai/dsh-core')).toEqual({ marker: 1 })
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths: [profileDir] })).toBe(join(f.installed, 'index.cjs'))
     const parent = pathToFileURL(join(profileDir, 'entry.mjs')).href
-    expect(resolveFrom('resolution-lib', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    expect(await importFrom('resolution-lib', parent)).toMatchObject({ marker: 1 })
-    expect(() => { createRequire(join(f.root, 'outside.cjs'))('resolution-lib') }).toThrow(/Cannot find module/u)
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
+    expect(await importFrom('@deepseek-ai/dsh-core', parent)).toMatchObject({ marker: 1 })
+    expect(registration.packageDir('@deepseek-ai/dsh-core', parent)).toBe(f.installed)
+    expect(createRequire(join(f.root, 'outside.cjs'))('@deepseek-ai/dsh-core')).toEqual({ marker: 2 })
   })
 
   it('does not reuse a default route for explicit CommonJS paths', async () => {
     const f = fixture()
     const alternative = join(f.root, 'alternative')
-    const alternativePackage = join(alternative, 'node_modules', 'resolution-lib')
-    pkg(alternativePackage, 'resolution-lib', 2)
-    const registration = installProfileResolution(await generationOf(f))
+    const alternativePackage = join(alternative, 'node_modules', '@deepseek-ai/dsh-core')
+    pkg(alternativePackage, '@deepseek-ai/dsh-core', 2)
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(require.resolve('resolution-lib', { paths: [alternative] })).toBe(join(alternativePackage, 'index.cjs'))
-    expect(require.resolve('resolution-lib', { paths: [f.profile.dir] })).toBe(join(f.installed, 'index.cjs'))
-    expect(require.resolve('resolution-lib', { paths: [join(f.root, 'missing'), f.profile.dir] }))
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(join(f.installed, 'index.cjs'))
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths: [alternative] })).toBe(join(alternativePackage, 'index.cjs'))
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths: [f.profile.dir] })).toBe(join(f.installed, 'index.cjs'))
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths: [join(f.root, 'missing'), f.profile.dir] }))
       .toBe(join(f.installed, 'index.cjs'))
     const relative = join(f.profile.dir, 'relative.cjs')
     file(relative, '')
     expect(require.resolve('./relative.cjs', { paths: [f.profile.dir] })).toBe(relative)
     const invalid = join(f.root, 'invalid')
-    file(join(invalid, 'node_modules', 'resolution-lib', 'package.json'), '{')
-    expect(() => { require.resolve('resolution-lib', { paths: [invalid, f.profile.dir] }) })
+    file(join(invalid, 'node_modules', '@deepseek-ai/dsh-core', 'package.json'), '{')
+    expect(() => { require.resolve('@deepseek-ai/dsh-core', { paths: [invalid, f.profile.dir] }) })
       .toThrow(/Invalid package config/u)
   })
 
   it('keeps earlier explicit CommonJS paths ahead of a managed local failure', async () => {
     const f = fixture()
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
-    const local = join(f.profile.dir, 'node_modules', 'resolution-lib')
+    const local = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
     file(join(local, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '2.0.0', exports: './missing.cjs',
+      name: '@deepseek-ai/dsh-core', version: '2.0.0', exports: './missing.cjs',
     }))
     const alternative = join(f.root, 'alternative')
-    const selected = join(alternative, 'node_modules', 'resolution-lib', 'index.cjs')
-    pkg(dirname(selected), 'resolution-lib', 3)
+    const selected = join(alternative, 'node_modules', '@deepseek-ai/dsh-core', 'index.cjs')
+    pkg(dirname(selected), '@deepseek-ai/dsh-core', 3)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     const paths = [alternative, f.profile.dir]
-    expect(require.resolve('resolution-lib', { paths })).toBe(selected)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths })).toBe(selected)
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
-    expect(require.resolve('resolution-lib', { paths })).toBe(selected)
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths })).toBe(selected)
   })
 
   it('keeps a missing legacy main before a managed explicit CommonJS path', async () => {
     const f = fixture()
     const invalid = join(f.root, 'invalid')
-    const selected = join(invalid, 'node_modules', 'resolution-lib')
-    file(join(selected, 'package.json'), JSON.stringify({ name: 'resolution-lib', main: './missing.cjs' }))
+    const selected = join(invalid, 'node_modules', '@deepseek-ai/dsh-core')
+    file(join(selected, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-core', main: './missing.cjs' }))
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     const paths = [invalid, f.profile.dir]
-    const linkError = thrownError(() => require.resolve('resolution-lib', { paths }))
-    const registration = installProfileResolution(await generationOf(f))
+    const nativeError = thrownError(() => require.resolve('@deepseek-ai/dsh-core', { paths }))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    const runtimeError = thrownError(() => require.resolve('resolution-lib', { paths }))
+    const runtimeError = thrownError(() => require.resolve('@deepseek-ai/dsh-core', { paths }))
 
     expect(runtimeError).toMatchObject({
-      code: linkError.code,
-      path: linkError.path,
-      requestPath: linkError.requestPath,
+      code: nativeError.code,
+      path: nativeError.path,
+      requestPath: nativeError.requestPath,
     })
-    expect(runtimeError.message).toBe(linkError.message)
+    expect(runtimeError.message).toBe(nativeError.message)
   })
 
   it('keeps a missing fallback legacy main before later explicit CommonJS paths', async () => {
@@ -422,51 +489,51 @@ describe('profile resolution generation', { concurrent: false }, () => {
     pkg(join(alternative, 'node_modules', name), name, 2)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     const paths = [f.profile.dir, alternative]
-    const linkError = thrownError(() => require.resolve(name, { paths }))
-    const registration = installProfileResolution(await generationOf(f))
+    const nativeError = thrownError(() => require.resolve(name, { paths }))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const runtimeError = thrownError(() => require.resolve(name, { paths }))
 
     expect(runtimeError).toMatchObject({
-      code: linkError.code,
-      path: linkError.path,
-      requestPath: linkError.requestPath,
+      code: nativeError.code,
+      path: nativeError.path,
+      requestPath: nativeError.requestPath,
     })
-    expect(runtimeError.message).toBe(linkError.message)
+    expect(runtimeError.message).toBe(nativeError.message)
   })
 
-  it('keeps a missing fallback legacy main after a generation miss', async () => {
+  it('keeps a missing fallback legacy main after a resolution miss', async () => {
     const f = fixture()
-    const selected = join(f.root, 'node_modules', 'resolution-lib')
-    file(join(selected, 'package.json'), JSON.stringify({ name: 'resolution-lib', main: './missing.cjs' }))
+    const selected = join(f.root, 'node_modules', '@deepseek-ai/dsh-core')
+    file(join(selected, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-core', main: './missing.cjs' }))
     const alternative = join(f.root, 'alternative')
-    pkg(join(alternative, 'node_modules', 'resolution-lib'), 'resolution-lib', 2)
-    const generation = await generationOf(f)
+    pkg(join(alternative, 'node_modules', '@deepseek-ai/dsh-core'), '@deepseek-ai/dsh-core', 2)
+    const resolution = await resolutionOf(f)
     rmSync(f.installed, { recursive: true })
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     const paths = [f.profile.dir, alternative]
-    const linkError = thrownError(() => require.resolve('resolution-lib', { paths }))
-    const registration = installProfileResolution(generation)
+    const nativeError = thrownError(() => require.resolve('@deepseek-ai/dsh-core', { paths }))
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
-    const runtimeError = thrownError(() => require.resolve('resolution-lib', { paths }))
+    const runtimeError = thrownError(() => require.resolve('@deepseek-ai/dsh-core', { paths }))
 
     expect(runtimeError).toMatchObject({
-      code: linkError.code,
-      path: linkError.path,
-      requestPath: linkError.requestPath,
+      code: nativeError.code,
+      path: nativeError.path,
+      requestPath: nativeError.requestPath,
     })
-    expect(runtimeError.message).toBe(linkError.message)
+    expect(runtimeError.message).toBe(nativeError.message)
   })
 
-  it('keeps a profile-local package ahead of the generation', async () => {
+  it('keeps a profile-local package ahead of the resolution', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
-      dependencies: { 'resolution-lib': '*', 'linked-local': '*' },
+      dependencies: { '@deepseek-ai/dsh-core': '*', 'linked-local': '*' },
     }))
-    const localResolution = join(f.profile.dir, 'node_modules', 'resolution-lib')
-    pkg(localResolution, 'resolution-lib', 2)
+    const localResolution = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
+    pkg(localResolution, '@deepseek-ai/dsh-core', 2)
     const linkedLocal = join(f.root, 'linked-local')
     pkg(linkedLocal, 'linked-local', 3)
     symlinkSync(
@@ -474,163 +541,120 @@ describe('profile resolution generation', { concurrent: false }, () => {
       join(f.profile.dir, 'node_modules', 'linked-local'),
       process.platform === 'win32' ? 'junction' : 'dir',
     )
-    const generation = await generationOf(f)
-    expect(generation.localPackageNames).toEqual(['resolution-lib', 'linked-local'])
-    const registration = installProfileResolution(generation)
+    const resolution = await resolutionOf(f)
+    expect(resolution.localPackageNames).toEqual(['@deepseek-ai/dsh-core', 'linked-local'])
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require('resolution-lib')).toEqual({ marker: 2 })
-    expect(require.resolve('resolution-lib', { paths: [f.profile.dir] }))
+    expect(require('@deepseek-ai/dsh-core')).toEqual({ marker: 2 })
+    expect(require.resolve('@deepseek-ai/dsh-core', { paths: [f.profile.dir] }))
       .toBe(join(localResolution, 'index.cjs'))
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
-    expect(resolveFrom('resolution-lib', parent)).toBe(
-      pathToFileURL(join(f.profile.dir, 'node_modules', 'resolution-lib', 'index.js')).href,
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent)).toBe(
+      pathToFileURL(join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core', 'index.js')).href,
     )
   })
 
   it('preserves an npm alias package self-reference', async () => {
     const f = fixture()
     file(f.installAnchor, JSON.stringify({
-      name: 'test-app',
+      name: '@deepseek-ai/dsh',
       version: '0.0.0',
       type: 'module',
       exports: { import: './index.js', require: './index.cjs' },
-      dependencies: { 'resolution-lib': '*', 'real-name': '*' },
+      dependencies: { '@deepseek-ai/dsh-core': '*', 'real-name': '*' },
     }))
     const installedRealName = join(dirname(f.installAnchor), 'node_modules', 'real-name')
     pkg(installedRealName, 'real-name', 7)
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
       dependencies: { alias: 'npm:real-name' },
     }))
     const alias = join(f.profile.dir, 'node_modules', 'alias')
     pkg(alias, 'real-name', 6)
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
-    expect(generation.localPackageNames).toEqual(['alias'])
+    expect(resolution.localPackageNames).toEqual(['alias'])
     const require = createRequire(join(alias, 'inside.cjs'))
     expect(require.resolve('real-name')).toBe(join(alias, 'index.cjs'))
     expect(require.resolve('real-name', { paths: [f.profile.dir] })).toBe(join(alias, 'index.cjs'))
-    expect(resolveFrom('real-name', pathToFileURL(join(alias, 'inside-link.mjs')).href)).toBe(
+    expect(resolveFrom('real-name', pathToFileURL(join(alias, 'inside-native.mjs')).href)).toBe(
       pathToFileURL(join(alias, 'index.js')).href,
     )
     const invalidScope = join(f.profile.dir, 'node_modules', 'invalid-scope')
     file(join(invalidScope, 'package.json'), '{')
-    expect(() => createRequire(join(invalidScope, 'inside.cjs')).resolve('resolution-lib'))
+    expect(() => createRequire(join(invalidScope, 'inside.cjs')).resolve('@deepseek-ai/dsh-core'))
       .toThrow(/Invalid package config/u)
-    expect(() => resolveFrom('resolution-lib', pathToFileURL(join(invalidScope, 'inside.mjs')).href))
+    expect(() => resolveFrom('@deepseek-ai/dsh-core', pathToFileURL(join(invalidScope, 'inside.mjs')).href))
       .toThrow(/Invalid package config/u)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'real-name'))
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
     expect(require.resolve('real-name')).toBe(join(alias, 'index.cjs'))
     expect(require.resolve('real-name', { paths: [f.profile.dir] })).toBe(join(alias, 'index.cjs'))
     expect(resolveFrom('real-name', pathToFileURL(join(alias, 'inside-runtime.mjs')).href)).toBe(
       pathToFileURL(join(alias, 'index.js')).href,
     )
-    expect(() => createRequire(join(invalidScope, 'inside.cjs')).resolve('resolution-lib'))
+    expect(() => createRequire(join(invalidScope, 'inside.cjs')).resolve('@deepseek-ai/dsh-core'))
       .toThrow(/Invalid package config/u)
-    expect(() => resolveFrom('resolution-lib', pathToFileURL(join(invalidScope, 'inside.mjs')).href))
+    expect(() => resolveFrom('@deepseek-ai/dsh-core', pathToFileURL(join(invalidScope, 'inside.mjs')).href))
       .toThrow(/Invalid package config/u)
   })
 
-  it('keeps package imports aliases on the generation route', async () => {
+  it('keeps package imports aliases on the resolution route', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
-      imports: { '#resolution-lib': 'resolution-lib' },
+      imports: { '#@deepseek-ai/dsh-core': '@deepseek-ai/dsh-core' },
     }))
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
     const nested = join(f.profile.dir, 'nested')
     const require = createRequire(join(nested, 'entry.cjs'))
-    const linkParent = pathToFileURL(join(nested, 'entry-link.mjs')).href
-    expect(require.resolve('#resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(resolveFrom('#resolution-lib', linkParent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
+    const nativeParent = pathToFileURL(join(nested, 'entry-native.mjs')).href
+    expect(() => require.resolve('#@deepseek-ai/dsh-core')).toThrow(/Cannot find module/u)
+    expect(() => resolveFrom('#@deepseek-ai/dsh-core', nativeParent)).toThrow(/Cannot find package/u)
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
     const runtimeParent = pathToFileURL(join(nested, 'entry-runtime.mjs')).href
-    expect(require.resolve('#resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(resolveFrom('#resolution-lib', runtimeParent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
+    expect(require.resolve('#@deepseek-ai/dsh-core')).toBe(join(f.installed, 'index.cjs'))
+    expect(resolveFrom('#@deepseek-ai/dsh-core', runtimeParent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
   })
 
-  it('verifies package imports aliases against the generation', async () => {
+  it('imports package aliases through the resolution and reports the original importer', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
-      imports: { '#resolution-lib': 'resolution-lib' },
+      imports: { '#library': '@deepseek-ai/dsh-core', '#missing': '@deepseek-ai/dsh-core/missing' },
     }))
-    const generation = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const registration = installProfileResolution(generation, 'verify')
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-
-    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('#resolution-lib'))
-      .toBe(realpathSync(join(f.installed, 'index.cjs')))
-    expect(resolveFrom(
-      '#resolution-lib', pathToFileURL(join(f.profile.dir, 'entry-dual.mjs')).href,
-    )).toBe(pathToFileURL(realpathSync(join(f.installed, 'index.js'))).href)
-  })
-
-  it('ignores a stale package imports projection and detects it in dual mode', async () => {
-    const f = fixture()
-    file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
-      private: true,
-      imports: { '#resolution-lib': 'resolution-lib' },
-    }))
-    const generation = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
+    const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
+    await expect(importFrom('#library', parent)).resolves.toMatchObject({ marker: 1 })
+    await expect(importFrom('#missing', parent)).rejects.toMatchObject({
+      code: 'ERR_PACKAGE_PATH_NOT_EXPORTED',
+      message: expect.stringContaining(fileURLToPath(parent)) as unknown as string,
     })
-    const projection = join(generation.profilesDir, 'node_modules', 'resolution-lib')
-    unlinkSync(projection)
-    const stale = join(f.root, 'stale', 'resolution-lib')
-    pkg(stale, 'resolution-lib', 9)
-    symlinkSync(stale, projection, process.platform === 'win32' ? 'junction' : 'dir')
-    const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-
-    const runtime = installProfileResolution(generation)
-    expect(require.resolve('#resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(resolveFrom(
-      '#resolution-lib', pathToFileURL(join(f.profile.dir, 'runtime.mjs')).href,
-    )).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
-    runtime.dispose()
-
-    const dual = installProfileResolution(generation, 'verify')
-    registrations.push(dual)
-    expect(() => require.resolve('#resolution-lib')).toThrow(/profile resolution mismatch/u)
-    expect(() => resolveFrom(
-      '#resolution-lib', pathToFileURL(join(f.profile.dir, 'dual-stale.mjs')).href,
-    )).toThrow(/profile resolution mismatch/u)
   })
 
   it('leaves relative package imports targets and their diagnostics to Node', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
       imports: { '#missing-relative': './missing.cjs' },
     }))
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
@@ -639,18 +663,17 @@ describe('profile resolution generation', { concurrent: false }, () => {
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
     const cjsMessage = thrownMessage(() => require.resolve('#missing-relative'))
     const esmMessage = thrownMessage(() => resolveFrom('#missing-relative', parent))
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
     expect(thrownMessage(() => require.resolve('#missing-relative'))).toBe(cjsMessage)
     expect(thrownMessage(() => resolveFrom('#missing-relative', parent))).toBe(esmMessage)
   })
 
-  it('keeps local and after-fallback package imports targets in native order', async () => {
+  it('keeps local and native-after-resolution package imports targets in native order', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
       imports: { '#local': 'local-import', '#ancestor': 'ancestor-import' },
     }))
@@ -662,7 +685,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
     expect(require.resolve('#local')).toBe(join(local, 'index.cjs'))
     expect(require.resolve('#ancestor')).toBe(join(ancestor, 'index.cjs'))
 
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     expect(require.resolve('#local')).toBe(join(local, 'index.cjs'))
     expect(require.resolve('#ancestor')).toBe(join(ancestor, 'index.cjs'))
@@ -675,119 +698,118 @@ describe('profile resolution generation', { concurrent: false }, () => {
       name: 'outside', private: true, imports: { '#missing': 'missing-target' },
     }))
     const require = createRequire(join(outside, 'entry.cjs'))
-    const linkMessage = thrownMessage(() => require.resolve('#missing'))
-    const registration = installProfileResolution(await generationOf(f))
+    const nativeMessage = thrownMessage(() => require.resolve('#missing'))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
 
-    expect(thrownMessage(() => require.resolve('#missing'))).toBe(linkMessage)
+    expect(thrownMessage(() => require.resolve('#missing'))).toBe(nativeMessage)
   })
 
   it('does not inherit package imports across node_modules', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile', private: true, imports: { '#resolution-lib': 'resolution-lib' },
+      name: 'dsh-profile-web', private: true, imports: { '#@deepseek-ai/dsh-core': '@deepseek-ai/dsh-core' },
     }))
     const nested = join(f.profile.dir, 'node_modules', 'manifestless', 'entry.cjs')
     file(nested, '')
     const require = createRequire(nested)
-    const linkMessage = thrownMessage(() => require.resolve('#resolution-lib'))
-    const registration = installProfileResolution(await generationOf(f))
+    const nativeMessage = thrownMessage(() => require.resolve('#@deepseek-ai/dsh-core'))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
 
-    expect(thrownMessage(() => require.resolve('#resolution-lib'))).toBe(linkMessage)
+    expect(thrownMessage(() => require.resolve('#@deepseek-ai/dsh-core'))).toBe(nativeMessage)
   })
 
-  it('falls through a missing local CommonJS subpath to the generation', async () => {
+  it('falls through a missing local CommonJS subpath to the resolution', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
-      dependencies: { 'resolution-lib': '*' },
+      dependencies: { '@deepseek-ai/dsh-core': '*' },
     }))
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', main: './index.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', main: './index.cjs',
     }))
     file(join(f.installed, 'only-install.cjs'), 'module.exports = { marker: 8 }\n')
     file(join(f.installed, 'legacy-install.cjs'), 'module.exports = { marker: 9 }\n')
-    const local = join(f.profile.dir, 'node_modules', 'resolution-lib')
+    const local = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
     file(join(local, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '2.0.0', type: 'module', main: './index.cjs',
+      name: '@deepseek-ai/dsh-core', version: '2.0.0', type: 'module', main: './index.cjs',
     }))
     file(join(local, 'index.cjs'), 'module.exports = { marker: 2 }\n')
-    const generation = await generationOf(f)
-    expect(generation.localPackageNames).toEqual(['resolution-lib'])
-    const registration = installProfileResolution(generation)
+    const resolution = await resolutionOf(f)
+    expect(resolution.localPackageNames).toEqual(['@deepseek-ai/dsh-core'])
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
 
-    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('resolution-lib/only-install.cjs'))
+    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('@deepseek-ai/dsh-core/only-install.cjs'))
       .toBe(join(f.installed, 'only-install.cjs'))
     rmSync(join(local, 'package.json'))
-    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('resolution-lib/legacy-install.cjs'))
+    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('@deepseek-ai/dsh-core/legacy-install.cjs'))
       .toBe(join(f.installed, 'legacy-install.cjs'))
   })
 
   it('treats null exports as legacy CommonJS package resolution', async () => {
     const f = fixture()
     file(join(f.profile.dir, 'package.json'), JSON.stringify({
-      name: 'test-profile',
+      name: 'dsh-profile-web',
       private: true,
-      dependencies: { 'resolution-lib': '*' },
+      dependencies: { '@deepseek-ai/dsh-core': '*' },
     }))
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', exports: null,
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', exports: null,
     }))
     const installedSubpath = join(f.installed, 'only-install.cjs')
     file(installedSubpath, 'module.exports = { marker: 8 }\n')
-    const local = join(f.profile.dir, 'node_modules', 'resolution-lib')
+    const local = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
     file(join(local, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '2.0.0', type: 'module', exports: null,
+      name: '@deepseek-ai/dsh-core', version: '2.0.0', type: 'module', exports: null,
     }))
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
     const require = createRequire(join(local, 'entry.cjs'))
-    expect(require.resolve('resolution-lib/only-install.cjs')).toBe(installedSubpath)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
+    expect(() => require.resolve('@deepseek-ai/dsh-core/only-install.cjs')).toThrow(/Cannot find module/u)
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
-    expect(require.resolve('resolution-lib/only-install.cjs')).toBe(installedSubpath)
+    expect(require.resolve('@deepseek-ai/dsh-core/only-install.cjs')).toBe(installedSubpath)
   })
 
-  it('stops a local CommonJS probe before the generation fallback position', async () => {
+  it('stops a local CommonJS probe before the resolution fallback position', async () => {
     const f = fixture()
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', main: './index.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', main: './index.cjs',
     }))
     const installedSubpath = join(f.installed, 'only-install.cjs')
     file(installedSubpath, 'module.exports = { marker: 8 }\n')
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
-    file(join(f.profile.dir, 'node_modules', 'resolution-lib', 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '2.0.0', main: './index.cjs',
+    file(join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core', 'package.json'), JSON.stringify({
+      name: '@deepseek-ai/dsh-core', version: '2.0.0', main: './index.cjs',
     }))
-    file(join(f.profile.dir, 'node_modules', 'resolution-lib', 'index.cjs'), 'module.exports = {}\n')
-    file(join(f.root, 'node_modules', 'resolution-lib', 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '3.0.0', exports: './index.cjs',
+    file(join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core', 'index.cjs'), 'module.exports = {}\n')
+    file(join(f.root, 'node_modules', '@deepseek-ai/dsh-core', 'package.json'), JSON.stringify({
+      name: '@deepseek-ai/dsh-core', version: '3.0.0', exports: './index.cjs',
     }))
-    file(join(f.root, 'node_modules', 'resolution-lib', 'index.cjs'), 'module.exports = {}\n')
+    file(join(f.root, 'node_modules', '@deepseek-ai/dsh-core', 'index.cjs'), 'module.exports = {}\n')
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib/only-install.cjs')).toBe(installedSubpath)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
+    expect(thrownError(() => require.resolve('@deepseek-ai/dsh-core/only-install.cjs')))
+      .toMatchObject({ code: 'ERR_PACKAGE_PATH_NOT_EXPORTED' })
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
-    expect(require.resolve('resolution-lib/only-install.cjs')).toBe(installedSubpath)
+    expect(require.resolve('@deepseek-ai/dsh-core/only-install.cjs')).toBe(installedSubpath)
   })
 
   it('observes a profile-local package installed after an earlier miss', async () => {
     const f = fixture()
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
@@ -806,7 +828,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
     const f = fixture()
     pkg(join(f.profile.dir, 'node_modules', 'undeclared-local'), 'undeclared-local', 6)
     file(join(f.profile.dir, 'relative.cjs'), 'module.exports = 7\n')
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     expect(require('undeclared-local')).toEqual({ marker: 6 })
@@ -837,89 +859,89 @@ describe('profile resolution generation', { concurrent: false }, () => {
     expect(internal.Module._resolveFilename('node:path', undefined, false)).toBe('node:path')
   })
 
-  it('keeps a legacy CommonJS package without a manifest ahead of the generation', async () => {
+  it('keeps a legacy CommonJS package without a manifest ahead of the resolution', async () => {
     const f = fixture()
-    file(join(f.profile.dir, 'node_modules', 'resolution-lib', 'index.js'), 'module.exports = { marker: 2 }\n')
-    const registration = installProfileResolution(await generationOf(f))
+    file(join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core', 'index.js'), 'module.exports = { marker: 2 }\n')
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    expect(createRequire(join(f.profile.dir, 'entry.cjs'))('resolution-lib')).toEqual({ marker: 2 })
+    expect(createRequire(join(f.profile.dir, 'entry.cjs'))('@deepseek-ai/dsh-core')).toEqual({ marker: 2 })
   })
 
-  it('keeps a manifestless local CommonJS subpath ahead of the generation', async () => {
+  it('keeps a manifestless local CommonJS subpath ahead of the resolution', async () => {
     const f = fixture()
-    const localSubpath = join(f.profile.dir, 'node_modules', 'resolution-lib', 'sub.cjs')
+    const localSubpath = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core', 'sub.cjs')
     file(localSubpath, 'module.exports = { marker: 2 }\n')
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib/sub.cjs')).toBe(localSubpath)
+    expect(require.resolve('@deepseek-ai/dsh-core/sub.cjs')).toBe(localSubpath)
 
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    expect(require.resolve('resolution-lib/sub.cjs')).toBe(localSubpath)
+    expect(require.resolve('@deepseek-ai/dsh-core/sub.cjs')).toBe(localSubpath)
   })
 
-  it('keeps a local extensionless CommonJS package ahead of the generation', async () => {
+  it('keeps a local extensionless CommonJS package ahead of the resolution', async () => {
     const f = fixture()
-    const local = join(f.profile.dir, 'node_modules', 'resolution-lib')
+    const local = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
     file(local, 'module.exports = { marker: 2 }\n')
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(local)
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(local)
 
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    expect(require.resolve('resolution-lib')).toBe(local)
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(local)
   })
 
-  it('keeps a local legacy main outside its package directory ahead of the generation', async () => {
+  it('keeps a local legacy main outside its package directory ahead of the resolution', async () => {
     const f = fixture()
-    const local = join(f.profile.dir, 'node_modules', 'resolution-lib')
-    const outside = join(f.profile.dir, 'node_modules', 'outside.cjs')
-    file(join(local, 'package.json'), JSON.stringify({ name: 'resolution-lib', main: '../outside.cjs' }))
+    const local = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
+    const outside = join(f.profile.dir, 'node_modules', '@deepseek-ai', 'outside.cjs')
+    file(join(local, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-core', main: '../outside.cjs' }))
     file(outside, 'module.exports = { marker: 2 }\n')
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(outside)
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(outside)
 
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    expect(require.resolve('resolution-lib')).toBe(outside)
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(outside)
   })
 
-  it('keeps a missing local legacy main error ahead of the generation', async () => {
+  it('keeps a missing local legacy main error ahead of the resolution', async () => {
     const f = fixture()
-    const local = join(f.profile.dir, 'node_modules', 'resolution-lib')
-    file(join(local, 'package.json'), JSON.stringify({ name: 'resolution-lib', main: './missing.cjs' }))
+    const local = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
+    file(join(local, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-core', main: './missing.cjs' }))
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    const linkError = thrownError(() => require.resolve('resolution-lib'))
-    const registration = installProfileResolution(await generationOf(f))
+    const nativeError = thrownError(() => require.resolve('@deepseek-ai/dsh-core'))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    const runtimeError = thrownError(() => require.resolve('resolution-lib'))
+    const runtimeError = thrownError(() => require.resolve('@deepseek-ai/dsh-core'))
 
     expect(runtimeError).toMatchObject({
-      code: linkError.code,
-      path: linkError.path,
-      requestPath: linkError.requestPath,
+      code: nativeError.code,
+      path: nativeError.path,
+      requestPath: nativeError.requestPath,
     })
-    expect(runtimeError.message).toBe(linkError.message)
+    expect(runtimeError.message).toBe(nativeError.message)
   })
 
-  it('keeps a profile-local CommonJS package file ahead of the generation', async () => {
+  it('keeps a profile-local CommonJS package file ahead of the resolution', async () => {
     const f = fixture()
-    file(join(f.profile.dir, 'node_modules', 'resolution-lib.js'), 'module.exports = { marker: 2 }\n')
-    const registration = installProfileResolution(await generationOf(f))
+    file(join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core.js'), 'module.exports = { marker: 2 }\n')
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    expect(createRequire(join(f.profile.dir, 'entry.cjs'))('resolution-lib')).toEqual({ marker: 2 })
-    expect(resolveFrom('resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href)).toBe(
+    expect(createRequire(join(f.profile.dir, 'entry.cjs'))('@deepseek-ai/dsh-core')).toEqual({ marker: 2 })
+    expect(resolveFrom('@deepseek-ai/dsh-core', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href)).toBe(
       pathToFileURL(join(f.installed, 'index.js')).href,
     )
   })
 
   it('preserves the ESM and CommonJS behavior of an empty local package directory', async () => {
     const f = fixture()
-    mkdirSync(join(f.profile.dir, 'node_modules', 'resolution-lib'), { recursive: true })
-    const registration = installProfileResolution(await generationOf(f))
+    mkdirSync(join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core'), { recursive: true })
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
-    expect(createRequire(join(f.profile.dir, 'entry.cjs'))('resolution-lib')).toEqual({ marker: 1 })
+    expect(createRequire(join(f.profile.dir, 'entry.cjs'))('@deepseek-ai/dsh-core')).toEqual({ marker: 1 })
     expect(() => resolveFrom(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
+      '@deepseek-ai/dsh-core', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
     )).toThrow(/Cannot find/u)
   })
 
@@ -935,7 +957,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
       patchPath: join(bundleDir, 'cordis.patch.yml'),
       patches: [],
     })
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     expect(createRequire(join(f.profile.dir, 'entry.cjs'))('bundle-only')).toEqual({ marker: 4 })
     const other = join(f.root, 'profiles', 'other', 'entry.cjs')
@@ -948,8 +970,8 @@ describe('profile resolution generation', { concurrent: false }, () => {
       .toThrow(/Cannot find module/u)
     expect(() => createRequire(other).resolve('missing-explicit', { paths: [dirname(other)] }))
       .toThrow(/Cannot find module/u)
-    file(join(f.root, 'node_modules', 'invalid-after-fallback', 'package.json'), '{')
-    expect(() => createRequire(other).resolve('invalid-after-fallback', {
+    file(join(f.root, 'node_modules', 'invalid-after-resolution', 'package.json'), '{')
+    expect(() => createRequire(other).resolve('invalid-after-resolution', {
       paths: [dirname(other), f.profile.dir],
     })).toThrow(/Invalid package config/u)
     file(join(f.root, 'node_modules', 'invalid-explicit', 'package.json'), '{')
@@ -958,112 +980,366 @@ describe('profile resolution generation', { concurrent: false }, () => {
     })).toThrow(/Invalid package config/u)
   })
 
-  it('keeps the generation ahead of packages above the shared fallback position', async () => {
+  it('keeps the resolution ahead of packages above the shared fallback position', async () => {
     const f = fixture()
-    pkg(join(f.root, 'node_modules', 'resolution-lib'), 'resolution-lib', 2)
-    const registration = installProfileResolution(await generationOf(f))
+    pkg(join(f.root, 'node_modules', '@deepseek-ai/dsh-core'), '@deepseek-ai/dsh-core', 2)
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require('resolution-lib')).toEqual({ marker: 1 })
-    expect(await importFrom('resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href))
+    expect(require('@deepseek-ai/dsh-core')).toEqual({ marker: 1 })
+    expect(await importFrom('@deepseek-ai/dsh-core', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href))
       .toMatchObject({ marker: 1 })
   })
 
-  it('continues the original ancestor lookup after a generation subpath miss', async () => {
+  it('continues the original ancestor lookup after a resolution subpath miss', async () => {
     const f = fixture()
     const home = join(f.root, 'home')
-    const profileDir = join(home, 'profiles', 'test')
+    const profileDir = join(home, 'profiles', 'web')
     const profile = {
       ...f.profile,
       dir: profileDir,
       patchPath: join(profileDir, 'cordis.patch.yml'),
     }
-    file(join(profileDir, 'package.json'), JSON.stringify({ name: 'test-profile', private: true }))
-    file(join(profileDir, 'node_modules', 'resolution-lib', 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '2.0.0',
+    file(join(profileDir, 'package.json'), JSON.stringify({ name: 'dsh-profile-web', private: true }))
+    file(join(profileDir, 'node_modules', '@deepseek-ai/dsh-core', 'package.json'), JSON.stringify({
+      name: '@deepseek-ai/dsh-core', version: '2.0.0',
     }))
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', main: './index.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', main: './index.cjs',
     }))
-    const ancestorSubpath = join(home, 'node_modules', 'resolution-lib', 'sub.cjs')
+    const ancestorSubpath = join(home, 'node_modules', '@deepseek-ai/dsh-core', 'sub.cjs')
     file(ancestorSubpath, 'module.exports = { marker: 3 }\n')
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile,
       home,
     })
     const require = createRequire(join(profileDir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(require.resolve('resolution-lib/sub.cjs')).toBe(ancestorSubpath)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
+    expect(() => require.resolve('@deepseek-ai/dsh-core')).toThrow(/Cannot find module/u)
+    expect(require.resolve('@deepseek-ai/dsh-core/sub.cjs')).toBe(ancestorSubpath)
 
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(require.resolve('resolution-lib/sub.cjs')).toBe(ancestorSubpath)
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(join(f.installed, 'index.cjs'))
+    expect(require.resolve('@deepseek-ai/dsh-core/sub.cjs')).toBe(ancestorSubpath)
   })
 
-  it('continues explicit CommonJS paths after a generation subpath miss', async () => {
+  it('continues explicit CommonJS paths after a resolution subpath miss', async () => {
     const f = fixture()
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', main: './index.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', main: './index.cjs',
     }))
     const alternative = join(f.root, 'alternative')
-    const alternativeSubpath = join(alternative, 'node_modules', 'resolution-lib', 'sub.cjs')
+    const alternativeSubpath = join(alternative, 'node_modules', '@deepseek-ai/dsh-core', 'sub.cjs')
     file(alternativeSubpath, 'module.exports = { marker: 4 }\n')
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
 
-    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('resolution-lib/sub.cjs', {
+    expect(createRequire(join(f.profile.dir, 'entry.cjs')).resolve('@deepseek-ai/dsh-core/sub.cjs', {
       paths: [f.profile.dir, alternative],
     })).toBe(alternativeSubpath)
   })
 
-  it('skips stale shared and profile-owned fallback entries when the generation misses', async () => {
+  it('occupies the interception layer package directory for a resolution hit and continues above it on a CommonJS subpath miss', async () => {
     const f = fixture()
-    pkg(join(f.root, 'profiles', 'node_modules', 'stale-shared'), 'stale-shared', 9)
-    pkg(join(f.root, 'node_modules', 'stale-shared'), 'stale-shared', 3)
-    const target = join(f.root, 'stale-private-target')
-    const owned = join(f.profile.dir, '.dsh-module-fallback', 'node_modules', 'stale-private')
-    const projected = join(f.profile.dir, 'node_modules', 'stale-private')
-    pkg(target, 'stale-private', 9)
-    mkdirSync(dirname(owned), { recursive: true })
-    symlinkSync(target, owned, process.platform === 'win32' ? 'junction' : 'dir')
-    mkdirSync(dirname(projected), { recursive: true })
-    symlinkSync(owned, projected, process.platform === 'win32' ? 'junction' : 'dir')
-    pkg(join(f.root, 'node_modules', 'stale-private'), 'stale-private', 3)
-    const registration = installProfileResolution(await generationOf(f))
+    file(join(f.installed, 'package.json'), JSON.stringify({
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', main: './index.cjs',
+    }))
+    // The resolution entry stands in for profiles/node_modules/@deepseek-ai/dsh-core, so this stale copy is never read.
+    const shared = join(f.root, 'profiles', 'node_modules', '@deepseek-ai/dsh-core')
+    file(join(shared, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-core', version: '9.0.0' }))
+    file(join(shared, 'sub.cjs'), 'module.exports = { marker: 9 }\n')
+    file(join(shared, 'sub.js'), 'module.exports = { marker: 9 }\n')
+    const home = join(f.root, 'node_modules', '@deepseek-ai/dsh-core')
+    file(join(home, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-core', version: '3.0.0' }))
+    file(join(home, 'sub.cjs'), 'module.exports = { marker: 3 }\n')
+    // A name without an entry sees the physical directory at the same layer.
+    pkg(join(f.root, 'profiles', 'node_modules', 'left-pad'), 'left-pad', 9)
+    pkg(join(f.root, 'node_modules', 'left-pad'), 'left-pad', 3)
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    for (const name of ['stale-shared', 'stale-private']) {
-      expect(require(name)).toEqual({ marker: 3 })
-      expect(require.resolve(name, { paths: [f.profile.dir] })).toBe(join(f.root, 'node_modules', name, 'index.cjs'))
-      expect(await importFrom(name, pathToFileURL(join(f.profile.dir, `${name}.mjs`)).href))
-        .toMatchObject({ marker: 3 })
-    }
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(join(f.installed, 'index.cjs'))
+    expect(require.resolve('@deepseek-ai/dsh-core/sub.cjs')).toBe(join(home, 'sub.cjs'))
+    expect(require('@deepseek-ai/dsh-core/sub.cjs')).toEqual({ marker: 3 })
+    expect(require.resolve('@deepseek-ai/dsh-core/sub.cjs', { paths: [f.profile.dir] })).toBe(join(home, 'sub.cjs'))
+    expect(require('left-pad')).toEqual({ marker: 9 })
+    // ESM resolves the subpath inside the selected package and never consults another copy.
+    const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent)).toBe(pathToFileURL(join(f.installed, 'index.cjs')).href)
+    await expect(importFrom('@deepseek-ai/dsh-core/sub.js', parent)).rejects.toMatchObject({ code: 'ERR_MODULE_NOT_FOUND' })
+    expect(await importFrom('left-pad', parent)).toMatchObject({ marker: 9 })
   })
 
-  it('continues after a canonicalized profiles directory from the matching parent tree', async () => {
-    const root = realpathSync(mkdtempSync(join(tmpdir(), 'dsh-profile-generation-symlink-')))
+  it.each(['profile', 'plugin'] as const)('uses the installation DSH package from a %s while a stale shared link remains', async (importer) => {
+    const name = '@deepseek-ai/dsh-core'
+    const f = fixture(name)
+    file(join(f.profile.dir, 'package.json'), JSON.stringify({
+      name: 'dsh-profile-web', private: true, dependencies: { [name]: '*' },
+      imports: { '#library': name },
+    }))
+    const parentDir = importer === 'profile' ? f.profile.dir : join(f.profile.dir, 'node_modules', 'my-plugin')
+    if (importer === 'plugin') {
+      pkg(parentDir, 'my-plugin', 1, { [name]: '*' })
+      file(join(parentDir, 'package.json'), JSON.stringify({
+        name: 'my-plugin', type: 'module', dependencies: { [name]: '*' }, imports: { '#library': name },
+      }))
+    }
+    const target = join(f.root, 'old-dsh', 'node_modules', name)
+    pkg(target, name, 9)
+    const shared = join(f.root, 'profiles', 'node_modules', name)
+    mkdirSync(dirname(shared), { recursive: true })
+    symlinkSync(target, shared, process.platform === 'win32' ? 'junction' : 'dir')
+    const resolution = await resolutionOf(f)
+    expect(resolution.localPackageNames).toEqual([])
+    const registration = installRuntimeInterception(resolution)
+    registrations.push(registration)
+    const require = createRequire(join(parentDir, 'entry.cjs'))
+    const parent = pathToFileURL(join(parentDir, 'entry.mjs')).href
+    for (const specifier of [name, '#library']) {
+      expect(require(specifier)).toEqual({ marker: 1 })
+      expect(require.resolve(specifier)).toBe(join(f.installed, 'index.cjs'))
+      expect(resolveFrom(specifier, parent)).toBe(pathToFileURL(join(f.installed, 'index.js')).href)
+      expect(await importFrom(specifier, parent))
+        .toMatchObject({ marker: 1 })
+    }
+    expect(registration.packageDir(name, parent)).toBe(f.installed)
+    expect(realpathSync(shared)).toBe(target)
+  })
+
+  it('treats a profile symlink into .dsh-module-fallback as an ordinary local package', async () => {
+    const f = fixture()
+    file(join(f.profile.dir, 'package.json'), JSON.stringify({
+      name: 'dsh-profile-web', private: true, dependencies: { '@deepseek-ai/dsh-core': '*' },
+    }))
+    const target = join(f.root, 'old-dsh', 'node_modules', '@deepseek-ai', 'dsh-core')
+    pkg(target, '@deepseek-ai/dsh-core', 9)
+    const owned = join(f.profile.dir, '.dsh-module-fallback', 'node_modules', '@deepseek-ai/dsh-core')
+    const projected = join(f.profile.dir, 'node_modules', '@deepseek-ai/dsh-core')
+    mkdirSync(dirname(owned), { recursive: true })
+    mkdirSync(dirname(projected), { recursive: true })
+    symlinkSync(target, owned, process.platform === 'win32' ? 'junction' : 'dir')
+    symlinkSync(owned, projected, process.platform === 'win32' ? 'junction' : 'dir')
+    const resolution = await resolutionOf(f)
+    expect(resolution.localPackageNames).toEqual(['@deepseek-ai/dsh-core'])
+    const registration = installRuntimeInterception(resolution)
+    registrations.push(registration)
+    const require = createRequire(join(f.profile.dir, 'entry.cjs'))
+    const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
+    expect(require('@deepseek-ai/dsh-core')).toEqual({ marker: 9 })
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(join(target, 'index.cjs'))
+    expect(resolveFrom('@deepseek-ai/dsh-core', parent)).toBe(pathToFileURL(join(target, 'index.js')).href)
+    expect(await importFrom('@deepseek-ai/dsh-core', parent)).toMatchObject({ marker: 9 })
+    expect(registration.packageDir('@deepseek-ai/dsh-core', parent)).toBe(projected)
+    expect(realpathSync(projected)).toBe(target)
+  })
+
+  it.each(['directory', 'symlink'] as const)('resolves an unlisted shared %s and its nested dependencies without changing profile files', async (layout) => {
+    const f = fixture()
+    const plugin = 'my-plugin'
+    const dependency = 'external-dependency'
+    const middle = 'external-middle'
+    const leaf = 'external-leaf'
+    const pluginDir = join(f.profile.dir, 'node_modules', plugin)
+    const shared = join(f.root, 'profiles', 'node_modules', dependency)
+    const selected = layout === 'directory' ? shared : join(f.root, 'workspace', dependency)
+    const middleDir = join(selected, 'node_modules', middle)
+    const leafDir = join(middleDir, 'node_modules', leaf)
+    file(join(f.profile.dir, 'package.json'), JSON.stringify({
+      name: 'dsh-profile-web', private: true, dependencies: { [plugin]: '*' },
+    }))
+    pkg(pluginDir, plugin, 1, { [dependency]: '*' })
+    pkg(selected, dependency, 2, { [middle]: '*' })
+    pkg(middleDir, middle, 3, { [leaf]: '*' })
+    pkg(leafDir, leaf, 4)
+    pkg(join(selected, 'node_modules', leaf), leaf, 8)
+    pkg(join(f.root, 'node_modules', dependency), dependency, 9)
+    file(join(pluginDir, 'index.js'), `import * as external from '${dependency}'\nexport { external }\n`)
+    file(join(pluginDir, 'index.cjs'), `module.exports = { external: require('${dependency}') }\n`)
+    for (const [dir, child] of [[selected, middle], [middleDir, leaf]] as const) {
+      file(join(dir, 'index.js'), `import * as child from '${child}'\nexport { child }\nexport const url = import.meta.url\n`)
+      file(join(dir, 'index.cjs'), `module.exports = { filename: __filename, child: require('${child}') }\n`)
+    }
+    file(join(leafDir, 'index.js'), 'export const marker = 4\nexport const url = import.meta.url\n')
+    file(join(leafDir, 'index.cjs'), 'module.exports = { marker: 4, filename: __filename }\n')
+    if (layout === 'symlink') {
+      mkdirSync(dirname(shared), { recursive: true })
+      symlinkSync(selected, shared, process.platform === 'win32' ? 'junction' : 'dir')
+    }
+    const resolution = await resolutionOf(f)
+    expect(resolution.entries.some(entry => [dependency, middle, leaf].includes(entry.name))).toBe(false)
+    const registration = installRuntimeInterception(resolution)
+    registrations.push(registration)
+    const require = createRequire(join(f.profile.dir, 'entry.cjs'))
+    const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
+    expect(require(plugin)).toEqual({
+      external: { filename: join(selected, 'index.cjs'), child: {
+        filename: join(middleDir, 'index.cjs'), child: { marker: 4, filename: join(leafDir, 'index.cjs') },
+      } },
+    })
+    expect(await importFrom(plugin, parent)).toMatchObject({
+      external: { url: pathToFileURL(join(selected, 'index.js')).href, child: {
+        url: pathToFileURL(join(middleDir, 'index.js')).href,
+        child: { marker: 4, url: pathToFileURL(join(leafDir, 'index.js')).href },
+      } },
+    })
+    expect(require.resolve(dependency, { paths: [pluginDir] })).toBe(join(selected, 'index.cjs'))
+    expect(registration.packageDir(dependency, pathToFileURL(join(pluginDir, 'index.js')).href)).toBe(shared)
+    expect(realpathSync(shared)).toBe(selected)
+    expect(existsSync(join(pluginDir, 'package.json'))).toBe(true)
+    expect(existsSync(join(leafDir, 'package.json'))).toBe(true)
+  })
+
+  it('loads the selected bundle plugin after a link-backend projection of a deselected bundle is removed', async () => {
+    const f = fixture()
+    const profileDir = join(f.root, 'profiles', 'web')
+    const modules = join(profileDir, 'node_modules')
+    const plugin = 'shared-plugin'
+    for (const [bundle, marker] of [['bundle-a', 1], ['bundle-b', 2]] as const) {
+      file(join(modules, bundle, 'package.json'), JSON.stringify({
+        name: bundle, version: '1.0.0', dependencies: { [plugin]: '*' }, dsh: { bundle: { patch: './cordis.patch.yml' } },
+      }))
+      file(join(modules, bundle, 'cordis.patch.yml'), '[]\n')
+      pkg(join(modules, bundle, 'node_modules', plugin), plugin, marker)
+    }
+    // A link-backend launch projected bundle-a's plugin while bundle-a was selected.
+    const owned = join(profileDir, '.dsh-module-fallback', 'node_modules', plugin)
+    mkdirSync(dirname(owned), { recursive: true })
+    symlinkSync(join(modules, 'bundle-a', 'node_modules', plugin), owned, process.platform === 'win32' ? 'junction' : 'dir')
+    symlinkSync(owned, join(modules, plugin), process.platform === 'win32' ? 'junction' : 'dir')
+    file(join(profileDir, 'package.json'), JSON.stringify({
+      name: 'dsh-profile-web', private: true,
+      dependencies: { 'bundle-a': '*', 'bundle-b': '*' },
+      dsh: { profile: { bundles: ['bundle-b'] } },
+    }))
+
+    const profile = loadProfile('dsh', 'web', f.installAnchor, f.root)
+    expect(profile.layers.map(layer => layer.packageName)).toEqual(['bundle-b'])
+    expect(existsSync(join(profileDir, '.dsh-module-fallback'))).toBe(false)
+    expect(existsSync(join(modules, plugin))).toBe(false)
+    const resolution = await createRuntimeResolution({ installAnchor: f.installAnchor, profile, home: f.root })
+    expect(resolution.entries.find(entry => entry.name === plugin)).toMatchObject({
+      packageDir: join(modules, 'bundle-b', 'node_modules', plugin), version: '2.0.0', scope: 'profile',
+    })
+    const registration = installRuntimeInterception(resolution)
+    registrations.push(registration)
+    expect(createRequire(join(profileDir, 'entry.cjs'))(plugin)).toEqual({ marker: 2 })
+    expect(await importFrom(plugin, pathToFileURL(join(profileDir, 'entry.mjs')).href)).toMatchObject({ marker: 2 })
+    expect(existsSync(join(modules, 'bundle-a', 'node_modules', plugin, 'package.json'))).toBe(true)
+  })
+
+  it('follows profile node_modules symlinks during selected bundle dependency traversal', async () => {
+    const f = fixture()
+    const bundle = join(f.profile.dir, 'node_modules', 'my-bundle')
+    pkg(bundle, 'my-bundle', 1, { 'bridge': '*' })
+    f.profile.layers.push({
+      packageName: 'my-bundle', packageDir: bundle,
+      patchPath: join(bundle, 'cordis.patch.yml'), patches: [],
+    })
+    const target = join(f.root, 'old-dsh', 'node_modules', 'bridge')
+    const owned = join(f.profile.dir, '.dsh-module-fallback', 'node_modules', 'bridge')
+    const projected = join(f.profile.dir, 'node_modules', 'bridge')
+    pkg(target, 'bridge', 9)
+    mkdirSync(dirname(owned), { recursive: true })
+    symlinkSync(target, owned, process.platform === 'win32' ? 'junction' : 'dir')
+    symlinkSync(owned, projected, process.platform === 'win32' ? 'junction' : 'dir')
+    const ancestor = join(f.root, 'node_modules', 'bridge')
+    pkg(ancestor, 'bridge', 3)
+    const resolution = await resolutionOf(f)
+    expect(resolution.entries.find(entry => entry.name === 'bridge'))
+      .toMatchObject({ packageDir: projected, version: '9.0.0', scope: 'profile' })
+    expect(realpathSync(projected)).toBe(target)
+  })
+
+  it.each(lookupMatrix())('$title', async (matrixCase) => {
+    const { importer, kind, layers, form } = matrixCase
+    const name = { installation: '@deepseek-ai/dsh-core', bundle: 'bridge', unlisted: 'left-pad' }[kind]
+    const f = fixture()
+    const pluginDir = join(f.profile.dir, 'node_modules', 'my-plugin')
+    pkg(pluginDir, 'my-plugin', 0)
+    const bundleDir = join(f.profile.dir, 'node_modules', 'my-bundle')
+    pkg(bundleDir, 'my-bundle', 0, { 'bridge': '*' })
+    const bundleLib = join(bundleDir, 'node_modules', 'bridge')
+    pkg(bundleLib, 'bridge', 2)
+    f.profile.layers.push({
+      packageName: 'my-bundle', packageDir: bundleDir,
+      patchPath: join(bundleDir, 'cordis.patch.yml'), patches: [],
+    })
+    file(join(f.profile.dir, 'package.json'), JSON.stringify({
+      name: 'dsh-profile-web', private: true, dependencies: { 'my-plugin': '*', 'my-bundle': '*' },
+    }))
+    const logical: Record<LookupLayer, string> = {
+      private: join(pluginDir, 'node_modules', name),
+      profile: join(f.profile.dir, 'node_modules', name),
+      shared: join(f.root, 'profiles', 'node_modules', name),
+      home: join(f.root, 'node_modules', name),
+    }
+    const real = { ...logical }
+    for (const layer of layers) {
+      if (form === 'symlink' && (layer === 'profile' || layer === 'shared')) {
+        real[layer] = join(f.root, 'linked', layer, name)
+        pkg(real[layer], name, LOOKUP_MARKERS[layer])
+        mkdirSync(dirname(logical[layer]), { recursive: true })
+        symlinkSync(real[layer], logical[layer], process.platform === 'win32' ? 'junction' : 'dir')
+      } else {
+        pkg(logical[layer], name, LOOKUP_MARKERS[layer])
+      }
+    }
+    const resolution = await resolutionOf(f)
+    expect(resolution.entries.find(entry => entry.name === name)?.scope)
+      .toBe(kind === 'installation' ? 'installation' : kind === 'bundle' ? 'profile' : undefined)
+    const registration = installRuntimeInterception(resolution)
+    registrations.push(registration)
+    const importerDir = importer === 'plugin' ? pluginDir : f.profile.dir
+    const require = createRequire(join(importerDir, 'entry.cjs'))
+    const parent = pathToFileURL(join(importerDir, 'entry.mjs')).href
+    const winner = lookupWinner(matrixCase)
+    if (winner === 'missing') {
+      expect(thrownError(() => require(name))).toMatchObject({ code: 'MODULE_NOT_FOUND' })
+      expect(thrownError(() => require.resolve(name, { paths: [importerDir] }))).toMatchObject({ code: 'MODULE_NOT_FOUND' })
+      await expect(importFrom(name, parent)).rejects.toMatchObject({ code: 'ERR_MODULE_NOT_FOUND' })
+      expect(registration.packageDir(name, parent)).toBeUndefined()
+      return
+    }
+    const packageDir = winner === 'interception'
+      ? (kind === 'installation' ? f.installed : bundleLib)
+      : logical[winner]
+    const realDir = winner === 'interception' ? packageDir : real[winner]
+    const marker = winner === 'interception' ? (kind === 'installation' ? 1 : 2) : LOOKUP_MARKERS[winner]
+    expect(require(name)).toEqual({ marker })
+    expect(require.resolve(name)).toBe(join(realDir, 'index.cjs'))
+    expect(require.resolve(name, { paths: [importerDir] })).toBe(join(realDir, 'index.cjs'))
+    expect(resolveFrom(name, parent)).toBe(pathToFileURL(join(realDir, 'index.js')).href)
+    expect(await importFrom(name, parent)).toMatchObject({ marker })
+    expect(registration.packageDir(name, parent)).toBe(packageDir)
+  })
+
+  it('uses shared packages in the canonicalized profiles tree before its ancestors', async () => {
+    const root = realpathSync.native(mkdtempSync(join(tmpdir(), 'dsh-profile-resolution-symlink-')))
     roots.push(root)
     const carrier = join(root, 'carrier')
     const profilesDir = join(root, 'home', 'profiles')
     const realProfilesDir = join(carrier, 'profiles')
-    const realProfileDir = join(realProfilesDir, 'test')
+    const realProfileDir = join(realProfilesDir, 'web')
     mkdirSync(realProfileDir, { recursive: true })
     mkdirSync(dirname(profilesDir), { recursive: true })
     symlinkSync(realProfilesDir, profilesDir, process.platform === 'win32' ? 'junction' : 'dir')
-    pkg(join(realProfilesDir, 'node_modules', 'stale-only'), 'stale-only', 9)
-    pkg(join(carrier, 'node_modules', 'stale-only'), 'stale-only', 3)
-    pkg(join(root, 'home', 'node_modules', 'stale-only'), 'stale-only', 4)
-    const registration = installProfileResolution({
+    pkg(join(realProfilesDir, 'node_modules', 'left-pad'), 'left-pad', 9)
+    const ancestor = join(carrier, 'node_modules', 'left-pad')
+    pkg(ancestor, 'left-pad', 3)
+    pkg(join(root, 'home', 'node_modules', 'left-pad'), 'left-pad', 4)
+    const registration = installRuntimeInterception({
       profilesDir,
-      profileDir: join(profilesDir, 'test'),
+      profileDir: join(profilesDir, 'web'),
       localPackageNames: [],
       entries: [],
     })
     registrations.push(registration)
-    expect(createRequire(join(realProfileDir, 'entry.cjs'))('stale-only')).toEqual({ marker: 3 })
+    const require = createRequire(join(realProfileDir, 'entry.cjs'))
+    expect(require('left-pad')).toEqual({ marker: 9 })
+    const parent = pathToFileURL(join(realProfileDir, 'entry.mjs')).href
+    expect(await importFrom('left-pad', parent)).toMatchObject({ marker: 9 })
+    expect(registration.packageDir('left-pad', parent)).toBe(join(realProfilesDir, 'node_modules', 'left-pad'))
   })
 
   it('leaves conditional exports to Node', async () => {
@@ -1071,7 +1347,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
     conditionalPkg(f.installed, 'conditional-lib', 11, 12)
     const local = join(f.profile.dir, 'node_modules', 'conditional-lib')
     conditionalPkg(local, 'conditional-lib', 21, 22)
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     expect(await importFrom('conditional-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href))
       .toMatchObject({ marker: 21 })
@@ -1100,10 +1376,10 @@ describe('profile resolution generation', { concurrent: false }, () => {
     expect(require.resolve('conditional-lib')).toBe(join(local, 'require.cjs'))
   })
 
-  it('passes explicit CommonJS conditions to the generation target', async () => {
+  it('passes explicit CommonJS conditions to the resolution target', async () => {
     const f = fixture('conditional-lib')
     conditionalPkg(f.installed, 'conditional-lib', 11, 12)
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const addon = createRequire(import.meta.url)('node-addon-require-builtin') as { requireBuiltin(id: string): unknown }
     const internal = addon.requireBuiltin('internal/modules/cjs/loader') as {
@@ -1130,7 +1406,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
 
   it('does not attach routed CommonJS anchors to the importing module', async () => {
     const f = fixture()
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const addon = createRequire(import.meta.url)('node-addon-require-builtin') as { requireBuiltin(id: string): unknown }
     const internal = addon.requireBuiltin('internal/modules/cjs/loader') as {
@@ -1150,68 +1426,66 @@ describe('profile resolution generation', { concurrent: false }, () => {
     parent.paths = internal.Module._nodeModulePaths(f.profile.dir)
     const originalChildren = [...parent.children]
 
-    expect(internal.Module._resolveFilename('resolution-lib', parent, false)).toBe(join(f.installed, 'index.cjs'))
+    expect(internal.Module._resolveFilename('@deepseek-ai/dsh-core', parent, false)).toBe(join(f.installed, 'index.cjs'))
     expect(parent.children).toEqual(originalChildren)
   })
 
   it('reports routed CommonJS failures with the native require stack', async () => {
     const f = fixture()
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', main: './index.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', main: './index.cjs',
     }))
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
-    const linkRequire = createRequire(join(f.profile.dir, 'entry-link.cjs'))
-    const linkError = thrownError(() => linkRequire.resolve('resolution-lib/missing.cjs'))
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
-    const registration = installProfileResolution(generation)
+    const nativeRequire = createRequire(join(f.profile.dir, 'entry-native.cjs'))
+    const nativeError = thrownError(() => nativeRequire.resolve('@deepseek-ai/dsh-core/missing.cjs'))
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
     const runtimeRequire = createRequire(join(f.profile.dir, 'entry-runtime.cjs'))
-    const runtimeError = thrownError(() => runtimeRequire.resolve('resolution-lib/missing.cjs'))
+    const runtimeError = thrownError(() => runtimeRequire.resolve('@deepseek-ai/dsh-core/missing.cjs'))
 
     expect(runtimeError.requireStack).toEqual([
       join(f.profile.dir, 'entry-runtime.cjs'),
     ])
     expect(runtimeError.message).not.toContain(f.installAnchor)
-    expect(linkError.requireStack).toEqual([join(f.profile.dir, 'entry-link.cjs')])
+    expect(nativeError.requireStack).toEqual([join(f.profile.dir, 'entry-native.cjs')])
   })
 
   it('reports routed ESM failures from the original importer', async () => {
     const f = fixture()
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
-    const linkMessage = thrownMessage(() => resolveFrom('unavailable-lib', parent))
-    const generation = await healProfilesModuleFallback({
+    const nativeMessage = thrownMessage(() => resolveFrom('unavailable-lib', parent))
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
-    const registration = installProfileResolution(generation)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
 
-    expect(thrownMessage(() => resolveFrom('unavailable-lib', parent))).toBe(linkMessage)
-    expect(thrownMessage(() => resolveFrom('resolution-lib/private', parent)))
+    expect(thrownMessage(() => resolveFrom('unavailable-lib', parent))).toBe(nativeMessage)
+    expect(thrownMessage(() => resolveFrom('@deepseek-ai/dsh-core/private', parent)))
       .toContain(` imported from ${fileURLToPath(parent)}`)
   })
 
-  it('leaves an invalid generation manifest error to Node', async () => {
+  it('leaves an invalid resolution manifest error to Node', async () => {
     const f = fixture()
-    const generation = await healProfilesModuleFallback({
+    const resolution = await createRuntimeResolution({
       installAnchor: f.installAnchor,
       profile: f.profile,
       home: f.root,
     })
     file(join(f.installed, 'package.json'), '{')
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
-    expect(() => resolveFrom('resolution-lib', parent)).toThrow(/Invalid package config/u)
-    unlinkSync(join(generation.profilesDir, 'node_modules', 'resolution-lib'))
-    const registration = installProfileResolution(generation)
+    expect(() => resolveFrom('@deepseek-ai/dsh-core', pathToFileURL(f.installAnchor).href))
+      .toThrow(/Invalid package config/u)
+    const registration = installRuntimeInterception(resolution)
     registrations.push(registration)
 
-    expect(() => resolveFrom('resolution-lib', parent)).toThrow(/Invalid package config/u)
+    expect(() => resolveFrom('@deepseek-ai/dsh-core', parent)).toThrow(/Invalid package config/u)
   })
 
   it('does not fall back after Node selects a broken profile-local package', async () => {
@@ -1220,7 +1494,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
       name: 'broken-lib',
       exports: './missing.js',
     }))
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
     expect(() => { require('broken-lib') }).toThrow(/Cannot find module|could not find/u)
@@ -1229,159 +1503,40 @@ describe('profile resolution generation', { concurrent: false }, () => {
     )).rejects.toThrow(/Cannot find module|Cannot find package/u)
   })
 
-  it('does not fall back after the generation selects a missing exports target', async () => {
+  it('does not fall back after the resolution selects a missing exports target', async () => {
     const f = fixture()
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', exports: './missing.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', exports: './missing.cjs',
     }))
-    pkg(join(f.root, 'node_modules', 'resolution-lib'), 'resolution-lib', 2)
-    const registration = installProfileResolution(await generationOf(f))
+    pkg(join(f.root, 'node_modules', '@deepseek-ai/dsh-core'), '@deepseek-ai/dsh-core', 2)
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
 
-    expect(() => createRequire(join(f.profile.dir, 'entry.cjs')).resolve('resolution-lib'))
+    expect(() => createRequire(join(f.profile.dir, 'entry.cjs')).resolve('@deepseek-ai/dsh-core'))
       .toThrow(/Cannot find module/u)
   })
 
-  it('does not fall back after the generation selects a missing legacy main', async () => {
+  it('does not fall back after the resolution selects a missing legacy main', async () => {
     const f = fixture()
     file(join(f.installed, 'package.json'), JSON.stringify({
-      name: 'resolution-lib', version: '1.0.0', type: 'module', main: './missing.cjs',
+      name: '@deepseek-ai/dsh-core', version: '1.0.0', type: 'module', main: './missing.cjs',
     }))
     unlinkSync(join(f.installed, 'index.cjs'))
     unlinkSync(join(f.installed, 'index.js'))
-    pkg(join(f.root, 'node_modules', 'resolution-lib'), 'resolution-lib', 2)
-    const registration = installProfileResolution(await generationOf(f))
+    pkg(join(f.root, 'node_modules', '@deepseek-ai/dsh-core'), '@deepseek-ai/dsh-core', 2)
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
 
-    expect(() => createRequire(join(f.profile.dir, 'entry.cjs')).resolve('resolution-lib'))
+    expect(() => createRequire(join(f.profile.dir, 'entry.cjs')).resolve('@deepseek-ai/dsh-core'))
       .toThrow(/valid "main" entry/u)
   })
 
-  it('detects a dual-mode mismatch instead of accepting another package', async () => {
-    const f = fixture()
-    const disk = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const second = join(f.root, 'second')
-    pkg(second, 'resolution-lib', 2)
-    const mismatched = {
-      ...disk,
-      entries: disk.entries.map(entry => entry.name === 'resolution-lib'
-        ? { ...entry, packageDir: second, declarer: join(second, 'package.json') }
-        : entry),
-    }
-    const registration = installProfileResolution(mismatched, 'verify')
-    registrations.push(registration)
-    const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(() => { require.resolve('resolution-lib') }).toThrow(/profile resolution mismatch/u)
-    await expect(importFrom(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
-    )).rejects.toThrow(/profile resolution mismatch/u)
-  })
-
-  it('detects a dual-mode package metadata mismatch before import', async () => {
-    const f = fixture()
-    const disk = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const second = join(f.root, 'second')
-    pkg(second, 'resolution-lib', 2)
-    const mismatched = {
-      ...disk,
-      entries: disk.entries.map(entry => entry.name === 'resolution-lib'
-        ? { ...entry, packageDir: second, declarer: join(second, 'package.json') }
-        : entry),
-    }
-    const registration = installProfileResolution(mismatched, 'verify')
-    registrations.push(registration)
-
-    expect(() => registration.packageDir(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'metadata.mjs')).href,
-    )).toThrow(/profile resolution mismatch/u)
-  })
-
-  it('detects a dual-mode package metadata hit present on only one backend', async () => {
-    const f = fixture()
-    const generation = await generationOf(f)
-    const registration = installProfileResolution(generation, 'verify')
-    registrations.push(registration)
-
-    expect(() => registration.packageDir(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'metadata.mjs')).href,
-    )).toThrow(/disk selected nothing, generation selected/u)
-  })
-
-  it('detects package metadata present only in the dual-mode disk backend', async () => {
-    const f = fixture()
-    const disk = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const registration = installProfileResolution({
-      ...disk,
-      entries: disk.entries.filter(entry => entry.name !== 'resolution-lib'),
-    }, 'verify')
-    registrations.push(registration)
-
-    expect(() => registration.packageDir(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'metadata.mjs')).href,
-    )).toThrow(/disk selected .*generation selected nothing/u)
-  })
-
-  it('reports a missing dual-mode generation target from the original importer', async () => {
-    const f = fixture()
-    const disk = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const missing = join(f.root, 'missing')
-    const mismatched = {
-      ...disk,
-      entries: disk.entries.map(entry => entry.name === 'resolution-lib'
-        ? { ...entry, packageDir: missing, declarer: join(missing, 'package.json') }
-        : entry),
-    }
-    const registration = installProfileResolution(mismatched, 'verify')
-    registrations.push(registration)
-    const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
-
-    expect(thrownMessage(() => resolveFrom('resolution-lib', parent))).toContain(fileURLToPath(parent))
-  })
-
-  it('accepts matching disk and generation targets in dual mode', async () => {
-    const f = fixture()
-    const generation = await healProfilesModuleFallback({
-      installAnchor: f.installAnchor,
-      profile: f.profile,
-      home: f.root,
-    })
-    const registration = installProfileResolution(generation, 'verify')
-    registrations.push(registration)
-    const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
-    expect(await importFrom('resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href))
-      .toMatchObject({ marker: 1 })
-    const parent = pathToFileURL(join(f.profile.dir, 'metadata.mjs')).href
-    expect(registration.packageDir('resolution-lib', parent)).toBe(f.installed)
-    expect(registration.packageDir('missing-metadata', parent)).toBeUndefined()
-    expect(registration.packageDir('node:fs', parent)).toBeUndefined()
-    expect(registration.packageDir(
-      'missing-metadata', `${pathToFileURL(f.profile.dir).href}/%ZZ`,
-    )).toBeUndefined()
-  })
-
-  it('publishes an additive generation and replaces its miss cache atomically', async () => {
+  it('publishes an additive resolution and replaces its miss cache atomically', async () => {
     const f = fixture()
     const added = join(f.root, 'added')
     pkg(added, 'added-lib', 2)
-    const first = await generationOf(f)
-    const registration = installProfileResolution(first)
+    const first = await resolutionOf(f)
+    const registration = installRuntimeInterception(first)
     registrations.push(registration)
     const parent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
     expect(registration.packageDir('added-lib', parent)).toBeUndefined()
@@ -1401,21 +1556,21 @@ describe('profile resolution generation', { concurrent: false }, () => {
   it('rejects changing an existing package mapping without publishing it', async () => {
     const f = fixture()
     const second = join(f.root, 'second')
-    pkg(second, 'resolution-lib', 2)
-    const first = await generationOf(f)
-    const registration = installProfileResolution(first)
+    pkg(second, '@deepseek-ai/dsh-core', 2)
+    const first = await resolutionOf(f)
+    const registration = installRuntimeInterception(first)
     registrations.push(registration)
-    const alias = join(f.root, 'resolution-lib-alias')
+    const alias = join(f.root, 'dsh-core-alias')
     symlinkSync(f.installed, alias, process.platform === 'win32' ? 'junction' : 'dir')
     registration.replace({
       ...first,
-      entries: first.entries.map(entry => entry.name === 'resolution-lib'
+      entries: first.entries.map(entry => entry.name === '@deepseek-ai/dsh-core'
         ? { ...entry, packageDir: alias }
         : entry),
     })
     const changed = {
       ...first,
-      entries: first.entries.map(entry => entry.name === 'resolution-lib'
+      entries: first.entries.map(entry => entry.name === '@deepseek-ai/dsh-core'
         ? { ...entry, packageDir: second, version: '2.0.0', declarer: join(second, 'package.json') }
         : entry),
     }
@@ -1423,16 +1578,16 @@ describe('profile resolution generation', { concurrent: false }, () => {
     expect(() => {
       registration.replace({
         ...first,
-        entries: first.entries.map(entry => entry.name === 'resolution-lib'
+        entries: first.entries.map(entry => entry.name === '@deepseek-ai/dsh-core'
           ? { ...entry, version: '9.0.0' }
           : entry),
       })
     }).toThrow(/requires a process restart/u)
     expect(() => {
-      registration.replace({ ...first, localPackageNames: ['resolution-lib'] })
+      registration.replace({ ...first, localPackageNames: ['@deepseek-ai/dsh-core'] })
     }).toThrow(/requires a process restart/u)
     expect(() => {
-      registration.replace({ ...first, entries: first.entries.filter(entry => entry.name !== 'resolution-lib') })
+      registration.replace({ ...first, entries: first.entries.filter(entry => entry.name !== '@deepseek-ai/dsh-core') })
     }).toThrow(/requires a process restart/u)
     expect(() => {
       registration.replace({ ...first, profilesDir: join(f.root, 'other-profiles') })
@@ -1441,7 +1596,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
     registration.replace({ ...first, localPackageNames: ['new-local'] })
     expect(() => { registration.replace(first) }).toThrow(/removing local package/u)
     expect(registration.packageDir(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
+      '@deepseek-ai/dsh-core', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
     )).toBe(f.installed)
   })
 
@@ -1454,7 +1609,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
     pkg(scopedPackage, '@scope/outside', 6)
     const ancestorPackage = join(f.root, 'node_modules', 'ancestor-lib')
     pkg(ancestorPackage, 'ancestor-lib', 7)
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
     registrations.push(registration)
     const profileParent = pathToFileURL(join(f.profile.dir, 'entry.mjs')).href
     const outsideParent = pathToFileURL(join(outside, 'entry.mjs')).href
@@ -1465,7 +1620,7 @@ describe('profile resolution generation', { concurrent: false }, () => {
     expect(registration.packageDir('#internal', profileParent)).toBeUndefined()
     expect(registration.packageDir('@scope', profileParent)).toBeUndefined()
     expect(registration.packageDir('node:fs', profileParent)).toBeUndefined()
-    expect(registration.packageDir('resolution-lib/private', profileParent)).toBe(f.installed)
+    expect(registration.packageDir('@deepseek-ai/dsh-core/private', profileParent)).toBe(f.installed)
     expect(registration.packageDir('outside-lib', outsideParent)).toBe(outsidePackage)
     expect(registration.packageDir('outside-lib', outsideParent)).toBe(outsidePackage)
     expect(registration.packageDir('@scope/outside', outsideParent)).toBe(scopedPackage)
@@ -1477,29 +1632,29 @@ describe('profile resolution generation', { concurrent: false }, () => {
     expect(registration.packageDir('missing', `${pathToFileURL(f.profile.dir).href}/%ZZ`)).toBeUndefined()
   })
 
-  it('leaves the published generation intact when successor construction fails', async () => {
+  it('leaves the published resolution intact when successor construction fails', async () => {
     const f = fixture()
-    const first = await generationOf(f)
-    const registration = installProfileResolution(first)
+    const first = await resolutionOf(f)
+    const registration = installRuntimeInterception(first)
     registrations.push(registration)
-    await expect(createProfileResolutionGeneration({
+    await expect(createRuntimeResolution({
       installAnchor: join(f.root, 'missing', 'package.json'),
       profile: f.profile,
       home: f.root,
     })).rejects.toThrow()
     expect(registration.packageDir(
-      'resolution-lib', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
+      '@deepseek-ai/dsh-core', pathToFileURL(join(f.profile.dir, 'entry.mjs')).href,
     )).toBe(f.installed)
   })
 
-  it('publishes and restores the generation inherited by owned Workers', async () => {
+  it('publishes and restores the resolution inherited by owned Workers', async () => {
     const f = fixture()
-    const generation = await generationOf(f)
+    const resolution = await resolutionOf(f)
     const key = '@deepseek-ai/dsh-app-boot/profile-resolution'
     const previous = getEnvironmentData(key)
-    const dispose = registerWorkerResolution(generation, 'verify')
+    const dispose = registerWorkerResolution(resolution)
     try {
-      expect(getEnvironmentData(key)).toEqual({ generation, behavior: 'verify' })
+      expect(getEnvironmentData(key)).toEqual({ resolution })
     } finally {
       dispose()
     }
@@ -1508,10 +1663,12 @@ describe('profile resolution generation', { concurrent: false }, () => {
 
   it('restores CommonJS resolution when the registration is disposed', async () => {
     const f = fixture()
-    const registration = installProfileResolution(await generationOf(f))
+    const registration = installRuntimeInterception(await resolutionOf(f))
+    registrations.push(registration)
     const require = createRequire(join(f.profile.dir, 'entry.cjs'))
-    expect(require.resolve('resolution-lib')).toBe(join(f.installed, 'index.cjs'))
+    expect(require.resolve('@deepseek-ai/dsh-core')).toBe(join(f.installed, 'index.cjs'))
     registration.dispose()
-    expect(() => { require.resolve('resolution-lib') }).toThrow(/Cannot find module/u)
+    registrations.pop()
+    expect(() => { require.resolve('@deepseek-ai/dsh-core') }).toThrow(/Cannot find module/u)
   })
 })
diff --git a/packages/boot/app-boot/tests/profile.spec.ts b/packages/boot/app-boot/tests/profile.spec.ts
index 324cebdb5f..fa6de1ddaf 100644
--- a/packages/boot/app-boot/tests/profile.spec.ts
+++ b/packages/boot/app-boot/tests/profile.spec.ts
@@ -1,36 +1,35 @@
 /**
  * Profile machinery of `dsh-app-boot`: directory resolution and init,
  * manifest round-trips, two-anchor bundle resolution, patch-layer loading,
- * empty-root composition, and the installation module-fallback healing.
+ * empty-root composition, and runtime package resolution.
  */
 
 import {
-  existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, realpathSync, rmSync, symlinkSync,
-  unlinkSync, writeFileSync,
+  existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, realpathSync, rmSync, symlinkSync, writeFileSync,
 } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { createRequire } from 'node:module'
-import { join } from 'node:path'
-import { withFileLock } from '@deepseek-ai/dsh-atomic-write'
+import { dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import { afterAll, describe, expect, it, onTestFinished, vi } from 'vitest'
 import {
   composeEntries,
-  createProfileResolutionGeneration,
-  healProfilesModuleFallback,
-  healIsolatedProfileModuleFallback,
+  createRuntimeResolution,
   initProfile,
-  unlinkProfileModuleFallback,
   loadProfile,
   loadProfileDirectory,
   PROFILE_PATCH_FILENAME,
   PROFILE_TEMPLATES,
   readProfileManifest,
   readProfilePatches,
+  removeLinkProjections,
   resolveBundleDir,
   resolveProfileDir,
   writeProfileManifest,
   type Profile,
+  type RuntimeResolution,
 } from '../src/index.ts'
+import { installRuntimeInterception } from '../src/profile-resolution/resolver.ts'
 
 const tempRoots: string[] = []
 afterAll(() => {
@@ -38,7 +37,7 @@ afterAll(() => {
 })
 
 const tmp = (): string => {
-  const dir = mkdtempSync(join(tmpdir(), 'dsh-profile-'))
+  const dir = realpathSync.native(mkdtempSync(join(tmpdir(), 'dsh-profile-')))
   tempRoots.push(dir)
   return dir
 }
@@ -93,13 +92,29 @@ function stageProfile(home: string, name: string, bundleAnchor: string): Profile
   }
 }
 
-describe('healIsolatedProfileModuleFallback', () => {
-  it.each([false, true])('resolves peers from each installation without sharing profile state (Web fallback: %s)', async (webFallback) => {
+async function importFromResolution(
+  resolution: RuntimeResolution, specifier: string,
+): Promise<Record<string, unknown>> {
+  const addon = createRequire(import.meta.url)('node-addon-require-builtin') as {
+    requireBuiltin(id: string): unknown
+  }
+  const loader = addon.requireBuiltin('internal/modules/esm/loader') as {
+    getOrInitializeCascadedLoader(): {
+      import(specifier: string, parent: string, attributes: ImportAttributes): Promise<Record<string, unknown>>
+    }
+  }
+  const registration = installRuntimeInterception(resolution)
+  try {
+    const parent = pathToFileURL(join(resolution.profilesDir, 'entry.mjs')).href
+    return await loader.getOrInitializeCascadedLoader().import(specifier, parent, {})
+  } finally {
+    registration.dispose()
+  }
+}
+
+describe('isolated profile resolution', () => {
+  it('resolves peers from each installation without sharing profile state', async () => {
     const home = tmp()
-    const webAnchor = stageInstallation({ commander: {} })
-    if (webFallback) await healProfilesModuleFallback({ installAnchor: webAnchor, home })
-    const sharedCommander = join(home, 'profiles', 'node_modules', 'commander')
-    const sharedTarget = webFallback ? readlinkSync(sharedCommander) : undefined
     const bundleAnchor = stageInstallation({ 'bundle-only': {} }, 'external-bundle')
     const anchorA = stageInstallation({ commander: {}, 'pnpm-owned': {} })
     const anchorB = stageInstallation({ commander: {}, 'pnpm-owned': {} })
@@ -119,53 +134,36 @@ describe('healIsolatedProfileModuleFallback', () => {
     writeFileSync(join(installed, 'package.json'), JSON.stringify({ name: 'pnpm-owned', main: 'index.js' }))
     writeFileSync(join(installed, 'index.js'), 'module.exports = "profile-installed"\n')
 
-    healIsolatedProfileModuleFallback({ installAnchor: anchorA, profile: profileA })
-    healIsolatedProfileModuleFallback({ installAnchor: anchorB, profile: profileB })
-    healIsolatedProfileModuleFallback({ installAnchor: anchorA, profile: profileA })
+    const resolutionA = await createRuntimeResolution({ installAnchor: anchorA, profile: profileA, home })
+    const resolutionB = await createRuntimeResolution({ installAnchor: anchorB, profile: profileB, home })
+    let registration = installRuntimeInterception(resolutionA)
+    try {
+      expect(realpathSync.native(createRequire(consumerA).resolve('commander')))
+        .toBe(realpathSync.native(join(anchorA, '..', 'node_modules', 'commander', 'index.js')))
+      registration.dispose()
+      registration = installRuntimeInterception(resolutionB)
+      expect(realpathSync.native(createRequire(consumerB).resolve('commander')))
+        .toBe(realpathSync.native(join(anchorB, '..', 'node_modules', 'commander', 'index.js')))
+      registration.dispose()
+      registration = installRuntimeInterception(resolutionA)
+      expect(realpathSync.native(createRequire(consumerA).resolve('pnpm-owned'))).toBe(realpathSync.native(join(installed, 'index.js')))
+      expect(readFileSync(join(installed, 'index.js'), 'utf8')).toContain('profile-installed')
+      expect(realpathSync.native(createRequire(consumerA).resolve('bundle-only')))
+        .toBe(realpathSync.native(join(bundleAnchor, '..', 'node_modules', 'bundle-only', 'index.js')))
+      expect(existsSync(join(home, 'profiles', 'node_modules'))).toBe(false)
 
-    expect(realpathSync.native(createRequire(consumerA).resolve('commander')))
-      .toBe(realpathSync.native(join(anchorA, '..', 'node_modules', 'commander', 'index.js')))
-    expect(realpathSync.native(createRequire(consumerB).resolve('commander')))
-      .toBe(realpathSync.native(join(anchorB, '..', 'node_modules', 'commander', 'index.js')))
-    expect(realpathSync.native(createRequire(consumerA).resolve('pnpm-owned'))).toBe(realpathSync.native(join(installed, 'index.js')))
-    expect(readFileSync(join(installed, 'index.js'), 'utf8')).toContain('profile-installed')
-    expect(realpathSync.native(createRequire(consumerA).resolve('bundle-only')))
-      .toBe(realpathSync.native(join(bundleAnchor, '..', 'node_modules', 'bundle-only', 'index.js')))
-    expect(existsSync(join(home, 'profiles', 'node_modules'))).toBe(webFallback)
-    if (webFallback) expect(readlinkSync(sharedCommander)).toBe(sharedTarget)
-
-    healIsolatedProfileModuleFallback({ installAnchor: anchorA, profile: { ...profileA, layers: [] } })
-    expect(existsSync(join(profileA.dir, 'node_modules', 'bundle-only'))).toBe(false)
-    expect(existsSync(join(profileB.dir, 'node_modules', 'bundle-only'))).toBe(true)
-    expect(realpathSync.native(createRequire(consumerA).resolve('commander')))
-      .toBe(realpathSync.native(join(anchorA, '..', 'node_modules', 'commander', 'index.js')))
-  })
-})
-
-describe('unlinkProfileModuleFallback', () => {
-  it('detaches only this profile projections and restores missing packages from a relocated installation', () => {
-    const home = tmp()
-    const anchor = stageInstallation({ fallback: {}, '@scope/peer': {}, replaced: {} })
-    const nextAnchor = stageInstallation({ fallback: {}, '@scope/peer': {}, replaced: {} })
-    const bundleAnchor = stageInstallation({}, 'selected-bundle')
-    const profile = stageProfile(home, 'desktop', bundleAnchor)
-    const other = stageProfile(home, 'other', bundleAnchor)
-    unlinkProfileModuleFallback(profile.dir)
-    healIsolatedProfileModuleFallback({ installAnchor: anchor, profile })
-    healIsolatedProfileModuleFallback({ installAnchor: anchor, profile: other })
-    const modules = join(profile.dir, 'node_modules')
-    unlinkSync(join(modules, 'replaced'))
-    mkdirSync(join(modules, 'replaced'))
-    writeFileSync(join(modules, 'replaced', 'sentinel'), 'pnpm')
-    unlinkProfileModuleFallback(profile.dir)
-    unlinkProfileModuleFallback(profile.dir)
-    expect(existsSync(join(modules, 'fallback'))).toBe(false)
-    expect(existsSync(join(modules, '@scope/peer'))).toBe(false)
-    expect(readFileSync(join(modules, 'replaced', 'sentinel'), 'utf8')).toBe('pnpm')
-    expect(existsSync(join(other.dir, 'node_modules', 'fallback'))).toBe(true)
-    healIsolatedProfileModuleFallback({ installAnchor: nextAnchor, profile })
-    expect(realpathSync(join(modules, 'fallback'))).toBe(realpathSync(join(nextAnchor, '..', 'node_modules', 'fallback')))
-    expect(readFileSync(join(modules, 'replaced', 'sentinel'), 'utf8')).toBe('pnpm')
+      registration.dispose()
+      registration = installRuntimeInterception(await createRuntimeResolution({
+        installAnchor: anchorA, profile: { ...profileA, layers: [] }, home,
+      }))
+      expect(() => createRequire(consumerA).resolve('bundle-only')).toThrow(/Cannot find module/u)
+      expect(resolutionB.entries.find(entry => entry.name === 'bundle-only')?.packageDir)
+        .toBe(realpathSync.native(join(bundleAnchor, '..', 'node_modules', 'bundle-only')))
+      expect(realpathSync.native(createRequire(consumerA).resolve('commander')))
+        .toBe(realpathSync.native(join(anchorA, '..', 'node_modules', 'commander', 'index.js')))
+    } finally {
+      registration.dispose()
+    }
   })
 })
 
@@ -383,12 +381,10 @@ describe('loadProfile', () => {
         .toEqual([{ id: 'a', name: 'pkg-a', config: { value: 'after' } }])
       expect(warn).toHaveBeenCalledWith(expect.stringContaining('skipping profile bundle "broken":'))
       expect(readFileSync(join(dir, 'package.json'), 'utf8')).toBe(saved)
-      const generation = await createProfileResolutionGeneration({ installAnchor: anchor, profile, home })
+      const resolution = await createRuntimeResolution({ installAnchor: anchor, profile, home })
       const unavailable = failure === 'missing package' || failure === 'invalid manifest'
-      expect(generation.entries.map(entry => entry.name))
+      expect(resolution.entries.map(entry => entry.name))
         .toEqual(['dsh-app', 'before', ...unavailable ? [] : ['broken'], 'after'])
-      healIsolatedProfileModuleFallback({ installAnchor: anchor, profile })
-      expect(existsSync(join(dir, 'node_modules', 'broken'))).toBe(!unavailable)
       mkdirSync(bundleDir, { recursive: true })
       writeFileSync(manifestPath, original)
       writeFileSync(patchPath, '[]\n')
@@ -423,8 +419,8 @@ describe('composeEntries', () => {
   })
 })
 
-describe('healProfilesModuleFallback', () => {
-  it('links the app and bundle dependency surface flat under profiles/node_modules', async () => {
+describe('createRuntimeResolution', () => {
+  it('collects the app and bundle dependencies without writing profile packages', async () => {
     const anchor = stageInstallation({
       'bundle-a': { patch: '[]\n', deps: { 'dep-of-a': '0.0.0', 'ghost-dep': '0.0.0' } },
       'plain-lib': {},
@@ -438,29 +434,11 @@ describe('healProfilesModuleFallback', () => {
     mkdirSync(join(modules, 'dep-of-a'), { recursive: true })
     writeFileSync(join(modules, 'dep-of-a', 'package.json'), JSON.stringify({ name: 'dep-of-a', version: '0.0.0' }))
     const home = tmp()
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    const fallback = join(home, 'profiles', 'node_modules')
-    // App deps, the bundle's own deps, and the bundle itself are linked; the
-    // plain library is linked as an app dep (harmless), the app itself too.
-    for (const name of ['bundle-a', 'plain-lib', 'dep-of-a', 'dsh-app']) {
-      expect(lstatSync(join(fallback, name)).isSymbolicLink(), name).toBe(true)
-    }
-    // Idempotent, and a moved target is re-pointed.
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    const before = readlinkSync(join(fallback, 'dep-of-a'))
-    expect(before).toContain('dep-of-a')
-  })
-
-  it('throws when a fallback entry is a foreign file or directory', async () => {
-    const anchor = stageInstallation({})
-    for (const kind of ['file', 'directory']) {
-      const home = tmp()
-      const entry = join(home, 'profiles', 'node_modules', 'dsh-app')
-      mkdirSync(join(entry, '..'), { recursive: true })
-      if (kind === 'directory') mkdirSync(entry)
-      else writeFileSync(entry, '')
-      await expect(healProfilesModuleFallback({ installAnchor: anchor, home })).rejects.toThrow('is not a symlink')
-    }
+    const resolution = await createRuntimeResolution({ installAnchor: anchor, home })
+    expect(resolution.entries.map(entry => entry.name)).toEqual(['dsh-app', 'bundle-a', 'plain-lib', 'dep-of-a'])
+    expect(resolution.entries.find(entry => entry.name === 'dep-of-a')?.packageDir).toBe(join(modules, 'dep-of-a'))
+    expect(existsSync(join(home, 'profiles', 'node_modules'))).toBe(false)
+    await expect(createRuntimeResolution({ installAnchor: anchor, home })).resolves.toEqual(resolution)
   })
 
   it('keeps selected bundle closures profile-local without overriding installation packages', async () => {
@@ -470,51 +448,37 @@ describe('healProfilesModuleFallback', () => {
     const home = tmp()
     const profileA = stageProfile(home, 'a', bundleA)
     const profileB = stageProfile(home, 'b', bundleB)
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile: profileA, home })
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile: profileA, home })
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile: profileB, home })
-    const sharedFallback = join(home, 'profiles', 'node_modules')
-    const ownedA = join(profileA.dir, '.dsh-module-fallback', 'node_modules', '@scope', 'bundle-only')
-    const ownedB = join(profileB.dir, '.dsh-module-fallback', 'node_modules', '@scope', 'bundle-only')
+    const resolutionA = await createRuntimeResolution({ installAnchor: installationAnchor, profile: profileA, home })
+    await expect(createRuntimeResolution({ installAnchor: installationAnchor, profile: profileA, home }))
+      .resolves.toEqual(resolutionA)
+    const resolutionB = await createRuntimeResolution({ installAnchor: installationAnchor, profile: profileB, home })
 
-    expect(realpathSync.native(readlinkSync(join(sharedFallback, 'shared'))))
-      .toBe(realpathSync.native(join(installationAnchor, '..', 'node_modules', 'shared')))
-    expect(existsSync(join(sharedFallback, '@scope', 'bundle-only'))).toBe(false)
+    for (const resolution of [resolutionA, resolutionB]) {
+      expect(resolution.entries.find(entry => entry.name === 'shared')).toMatchObject({
+        packageDir: join(installationAnchor, '..', 'node_modules', 'shared'), scope: 'installation',
+      })
+    }
+    expect(existsSync(join(home, 'profiles', 'node_modules'))).toBe(false)
     expect(existsSync(join(profileA.dir, 'node_modules', 'shared'))).toBe(false)
     expect(existsSync(join(profileB.dir, 'node_modules', 'shared'))).toBe(false)
-    expect(readlinkSync(join(profileA.dir, 'node_modules', '@scope', 'bundle-only'))).toBe(ownedA)
-    expect(readlinkSync(ownedA))
-      .toBe(realpathSync.native(join(bundleA, '..', 'node_modules', '@scope', 'bundle-only')))
-    expect(readlinkSync(join(profileB.dir, 'node_modules', '@scope', 'bundle-only'))).toBe(ownedB)
-    expect(readlinkSync(ownedB))
-      .toBe(realpathSync.native(join(bundleB, '..', 'node_modules', '@scope', 'bundle-only')))
+    expect(resolutionA.entries.find(entry => entry.name === '@scope/bundle-only')).toMatchObject({
+      packageDir: realpathSync.native(join(bundleA, '..', 'node_modules', '@scope', 'bundle-only')), scope: 'profile',
+    })
+    expect(resolutionB.entries.find(entry => entry.name === '@scope/bundle-only')).toMatchObject({
+      packageDir: realpathSync.native(join(bundleB, '..', 'node_modules', '@scope', 'bundle-only')), scope: 'profile',
+    })
 
-    await healProfilesModuleFallback({
+    const withoutBundles = await createRuntimeResolution({
       installAnchor: installationAnchor,
       profile: { ...profileA, layers: [] },
       home,
     })
-    expect(existsSync(join(profileA.dir, 'node_modules', '@scope', 'bundle-only'))).toBe(false)
-    expect(existsSync(ownedA)).toBe(false)
-    expect(existsSync(join(profileB.dir, 'node_modules', '@scope', 'bundle-only'))).toBe(true)
+    expect(withoutBundles.entries.some(entry => entry.name === '@scope/bundle-only')).toBe(false)
+    expect(resolutionB.entries.find(entry => entry.name === '@scope/bundle-only')?.packageDir)
+      .toBe(realpathSync.native(join(bundleB, '..', 'node_modules', '@scope', 'bundle-only')))
   })
 
-  it('combines packaged installation proxies with profile-local bundle links', async () => {
-    const installationAnchor = stageInstallation({ shared: {} })
-    const bundleAnchor = stageInstallation({ shared: {}, 'bundle-only': {} }, 'selected-bundle')
-    const home = tmp()
-    const profile = stageProfile(home, 'packaged', bundleAnchor)
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
-      expect(lstatSync(join(home, 'profiles', 'node_modules', 'shared')).isDirectory()).toBe(true)
-      expect(lstatSync(join(profile.dir, 'node_modules', 'bundle-only')).isSymbolicLink()).toBe(true)
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
-  })
-
-  it('discovers dependencies beside a symlinked bundle real path', async () => {
+  it.each([false, true])('discovers dependencies beside a symlinked bundle real path (packaged: %s)', async (packaged) => {
     const installationAnchor = stageInstallation({})
     const home = tmp()
     const dir = resolveProfileDir('symlinked', home)
@@ -545,10 +509,16 @@ describe('healProfilesModuleFallback', () => {
       patches: [],
     }
 
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
-
-    expect(readlinkSync(join(dir, '.dsh-module-fallback', 'node_modules', 'bundle-only')))
-      .toBe(realpathSync.native(realDependency))
+    const previous = Object.getOwnPropertyDescriptor(process, 'pkg')
+    Object.defineProperty(process, 'pkg', { configurable: true, value: packaged ? {} : undefined })
+    try {
+      const resolution = await createRuntimeResolution({ installAnchor: installationAnchor, profile, home })
+      expect(resolution.entries.find(entry => entry.name === 'bundle-only')?.packageDir)
+        .toBe(realpathSync.native(realDependency))
+    } finally {
+      if (previous === undefined) Reflect.deleteProperty(process, 'pkg')
+      else Object.defineProperty(process, 'pkg', previous)
+    }
   })
 
   it('traverses every explicit bundle root even when a nested package has the same name', async () => {
@@ -589,226 +559,10 @@ describe('healProfilesModuleFallback', () => {
       patches: [],
     }
 
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
+    const resolution = await createRuntimeResolution({ installAnchor: installationAnchor, profile, home })
 
-    const ownedModules = join(dir, '.dsh-module-fallback', 'node_modules')
-    expect(readlinkSync(join(ownedModules, 'nested-only'))).toBe(realpathSync.native(nestedOnly))
-    expect(readlinkSync(join(ownedModules, 'explicit-only'))).toBe(realpathSync.native(explicitOnly))
-  })
-
-  it('ignores owned projections while recomputing an ordered bundle closure', async () => {
-    const installationAnchor = stageInstallation({})
-    const home = tmp()
-    const dir = resolveProfileDir('ordered', home)
-    const profileModules = join(dir, 'node_modules')
-    const bundleA = join(profileModules, 'bundle-a')
-    const bundleB = join(profileModules, 'bundle-b')
-    const nested = join(bundleB, 'node_modules', 'bundle-only')
-    mkdirSync(bundleA, { recursive: true })
-    mkdirSync(nested, { recursive: true })
-    writeFileSync(join(bundleA, 'package.json'), JSON.stringify({
-      name: 'bundle-a',
-      peerDependencies: { 'bundle-only': '0.0.0' },
-    }))
-    writeFileSync(join(bundleB, 'package.json'), JSON.stringify({
-      name: 'bundle-b',
-      dependencies: { 'bundle-only': '0.0.0' },
-    }))
-    writeFileSync(join(nested, 'package.json'), JSON.stringify({ name: 'bundle-only' }))
-    const profile: Profile = {
-      name: 'ordered',
-      dir,
-      layers: ([['bundle-a', bundleA], ['bundle-b', bundleB]] as const).map(([packageName, packageDir]) => ({
-        packageDir,
-        packageName,
-        patchPath: join(packageDir, 'cordis.patch.yml'),
-        patches: [],
-      })),
-      patchPath: join(dir, PROFILE_PATCH_FILENAME),
-      patches: [],
-    }
-
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
-
-    const owned = join(dir, '.dsh-module-fallback', 'node_modules', 'bundle-only')
-    expect(readlinkSync(owned)).toBe(realpathSync.native(nested))
-    expect(JSON.parse(readFileSync(join(profileModules, 'bundle-only', 'package.json'), 'utf8')))
-      .toMatchObject({ name: 'bundle-only' })
-  })
-
-  it('cleans owned projections without removing profile-managed entries', async () => {
-    const installationAnchor = stageInstallation({})
-    const bundleAnchor = stageInstallation({ fallback: {}, 'managed-dir': {}, 'managed-link': {} }, 'selected-bundle')
-    const home = tmp()
-    const profile = stageProfile(home, 'managed', bundleAnchor)
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
-    const ownedModules = join(profile.dir, '.dsh-module-fallback', 'node_modules')
-    const profileModules = join(profile.dir, 'node_modules')
-    const foreignTarget = tmp()
-    unlinkSync(join(profileModules, 'managed-dir'))
-    mkdirSync(join(profileModules, 'managed-dir'))
-    unlinkSync(join(profileModules, 'managed-link'))
-    symlinkSync(foreignTarget, join(profileModules, 'managed-link'), 'junction')
-    mkdirSync(join(ownedModules, 'foreign-directory'))
-    mkdirSync(join(ownedModules, '@foreign', 'directory'), { recursive: true })
-
-    await healProfilesModuleFallback({
-      installAnchor: installationAnchor,
-      profile: { ...profile, layers: [] },
-      home,
-    })
-
-    expect(existsSync(join(profileModules, 'fallback'))).toBe(false)
-    expect(lstatSync(join(profileModules, 'managed-dir')).isDirectory()).toBe(true)
-    expect(readlinkSync(join(profileModules, 'managed-link'))).toBe(foreignTarget)
-    expect(existsSync(join(ownedModules, 'fallback'))).toBe(false)
-    expect(existsSync(join(ownedModules, 'managed-dir'))).toBe(false)
-    expect(existsSync(join(ownedModules, 'managed-link'))).toBe(false)
-  })
-
-  it('cleans owned projections whose junction target uses a canonical parent path', async () => {
-    const installationAnchor = stageInstallation({})
-    const realHome = tmp()
-    const aliasRoot = tmp()
-    const home = join(aliasRoot, 'home')
-    symlinkSync(realHome, home, 'junction')
-    const bundleAnchor = stageInstallation({ fallback: {} }, 'selected-bundle')
-    const profile = stageProfile(home, 'canonical', bundleAnchor)
-    await healProfilesModuleFallback({ installAnchor: installationAnchor, profile, home })
-    const profileLink = join(profile.dir, 'node_modules', 'fallback')
-    const ownedModules = join(profile.dir, '.dsh-module-fallback', 'node_modules')
-    unlinkSync(profileLink)
-    symlinkSync(join(realpathSync(ownedModules), 'fallback'), profileLink, 'junction')
-
-    await healProfilesModuleFallback({
-      installAnchor: installationAnchor,
-      profile: { ...profile, layers: [] },
-      home,
-    })
-
-    expect(existsSync(profileLink)).toBe(false)
-    expect(existsSync(join(ownedModules, 'fallback'))).toBe(false)
-  })
-
-  it('replaces a wrong symlink', async () => {
-    const anchor = stageInstallation({})
-    const home = tmp()
-    const fallback = join(home, 'profiles', 'node_modules')
-    mkdirSync(fallback, { recursive: true })
-    symlinkSync(tmp(), join(fallback, 'dsh-app'), 'junction')
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    expect(readlinkSync(join(fallback, 'dsh-app'))).toContain('app')
-  })
-
-  it('retains current links while repairing a missing sibling', async () => {
-    const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
-    const home = tmp()
-    const fallback = join(home, 'profiles', 'node_modules')
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    const appTarget = readlinkSync(join(fallback, 'dsh-app'))
-    unlinkSync(join(fallback, 'bundle-a'))
-
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-
-    expect(readlinkSync(join(fallback, 'dsh-app'))).toBe(appTarget)
-    expect(lstatSync(join(fallback, 'bundle-a')).isSymbolicLink()).toBe(true)
-  })
-
-  it('serializes concurrent healers and retains the identical link', async () => {
-    const anchor = stageInstallation({})
-    const home = tmp()
-    await Promise.all([
-      healProfilesModuleFallback({ installAnchor: anchor, home }),
-      healProfilesModuleFallback({ installAnchor: anchor, home }),
-    ])
-    const fallback = join(home, 'profiles', 'node_modules')
-    expect(lstatSync(join(fallback, 'dsh-app')).isSymbolicLink()).toBe(true)
-  })
-
-  it('does not acquire the writer lock for a complete generation', async () => {
-    const anchor = stageInstallation({})
-    const home = tmp()
-    const modules = join(home, 'profiles', 'node_modules')
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    let releaseLock: (() => void) | undefined
-    let reportLock: (() => void) | undefined
-    const lockHeld = new Promise<void>((resolve) => { reportLock = resolve })
-    const release = new Promise<void>((resolve) => { releaseLock = resolve })
-    const holder = withFileLock(modules, async () => {
-      reportLock?.()
-      await release
-    })
-    await lockHeld
-
-    const healer = healProfilesModuleFallback({ installAnchor: anchor, home })
-    const outcome = await Promise.race([
-      healer.then(() => 'complete' as const),
-      new Promise<'blocked'>(resolve => setTimeout(() => { resolve('blocked') }, 100)),
-    ])
-    releaseLock?.()
-    await Promise.all([holder, healer])
-    expect(outcome).toBe('complete')
-  })
-
-  it('waits for the module-fallback writer lock before publishing entries', async () => {
-    const anchor = stageInstallation({})
-    const home = tmp()
-    const modules = join(home, 'profiles', 'node_modules')
-    mkdirSync(modules, { recursive: true })
-    let releaseLock: (() => void) | undefined
-    let reportLock: (() => void) | undefined
-    const lockHeld = new Promise<void>((resolve) => { reportLock = resolve })
-    const release = new Promise<void>((resolve) => { releaseLock = resolve })
-    const holder = withFileLock(modules, async () => {
-      reportLock?.()
-      await release
-    })
-    await lockHeld
-
-    const healer = healProfilesModuleFallback({ installAnchor: anchor, home })
-    await new Promise(resolve => setTimeout(resolve, 20))
-    expect(existsSync(join(modules, 'dsh-app'))).toBe(false)
-    releaseLock?.()
-    await Promise.all([holder, healer])
-    expect(lstatSync(join(modules, 'dsh-app')).isSymbolicLink()).toBe(true)
-  })
-
-  it('writes real ESM proxies for a packaged executable', async () => {
-    const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
-    const bundleDir = join(anchor, '..', 'node_modules', 'bundle-a')
-    const bundleManifest = JSON.parse(readFileSync(join(bundleDir, 'package.json'), 'utf8')) as Record<string, unknown>
-    bundleManifest.exports = {
-      '.': './index.js',
-      './feature': './feature.js',
-      './legacy/': './legacy/',
-      './types': { types: './feature.d.ts' },
-    }
-    writeFileSync(join(bundleDir, 'package.json'), JSON.stringify(bundleManifest))
-    writeFileSync(join(bundleDir, 'feature.js'), 'export const feature = "proxied"\n')
-    const home = tmp()
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      const fallback = join(home, 'profiles', 'node_modules')
-      const proxy = join(fallback, 'bundle-a')
-      expect(lstatSync(proxy).isDirectory()).toBe(true)
-      const proxyManifest = JSON.parse(readFileSync(join(proxy, 'package.json'), 'utf8')) as {
-        version: unknown
-        exports: unknown
-        dsh: { moduleFallback: { targets: Record<string, unknown> } }
-      }
-      expect(proxyManifest).toMatchObject({
-        version: '0.0.0',
-        exports: { '.': './entry-0.js', './feature': './entry-1.js' },
-      })
-      expect(proxyManifest.dsh.moduleFallback.targets['.']).toEqual(expect.stringContaining('/bundle-a/index.js'))
-      await expect(import(join(proxy, 'entry-0.js'))).resolves.toMatchObject({ packageName: 'bundle-a' })
-      await expect(import(join(proxy, 'entry-1.js'))).resolves.toMatchObject({ feature: 'proxied' })
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    expect(resolution.entries.find(entry => entry.name === 'nested-only')?.packageDir).toBe(realpathSync.native(nestedOnly))
+    expect(resolution.entries.find(entry => entry.name === 'explicit-only')?.packageDir).toBe(realpathSync.native(explicitOnly))
   })
 
   it('resolves import-only exports from each package installation', async () => {
@@ -827,20 +581,14 @@ describe('healProfilesModuleFallback', () => {
       type: 'module',
       exports: { import: './index.js' },
     }))
-    writeFileSync(join(nestedDir, 'index.js'), 'export const nested = "proxied"\n')
+    writeFileSync(join(nestedDir, 'index.js'), 'export const nested = "selected"\n')
     const home = tmp()
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      const fallback = join(home, 'profiles', 'node_modules')
-      await expect(import(join(fallback, 'bundle-a', 'entry-0.js'))).resolves.toMatchObject({ packageName: 'bundle-a' })
-      await expect(import(join(fallback, 'nested-esm', 'entry-0.js'))).resolves.toMatchObject({ nested: 'proxied' })
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    const resolution = await createRuntimeResolution({ installAnchor: anchor, home })
+    await expect(importFromResolution(resolution, 'bundle-a')).resolves.toMatchObject({ packageName: 'bundle-a' })
+    await expect(importFromResolution(resolution, 'nested-esm')).resolves.toMatchObject({ nested: 'selected' })
   })
 
-  it('resolves explicit condition targets without filesystem package lookup', async () => {
+  it('resolves conditional subpath exports through Node', async () => {
     const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
     const bundleDir = join(anchor, '..', 'node_modules', 'bundle-a')
     const manifest = JSON.parse(readFileSync(join(bundleDir, 'package.json'), 'utf8')) as Record<string, unknown>
@@ -854,45 +602,10 @@ describe('healProfilesModuleFallback', () => {
     writeFileSync(join(bundleDir, 'mini', 'index.js'), 'export const mini = true\n')
     mkdirSync(join(bundleDir, 'dist', 'web'), { recursive: true })
     writeFileSync(join(bundleDir, 'dist', 'web', 'index.mjs'), 'export const web = true\n')
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      const home = tmp()
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      const proxy = join(home, 'profiles', 'node_modules', 'bundle-a')
-      await expect(import(join(proxy, 'entry-1.js'))).resolves.toMatchObject({ mini: true })
-      await expect(import(join(proxy, 'entry-2.js'))).resolves.toMatchObject({ web: true })
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
-  })
-
-  it('preserves the installation path while resolving packaged exports', async () => {
-    const anchor = stageInstallation({})
-    const appDir = join(anchor, '..')
-    const physical = tmp()
-    writeFileSync(join(physical, 'package.json'), JSON.stringify({
-      name: 'linked-esm',
-      version: '0.0.0',
-      type: 'module',
-      exports: { import: './index.js' },
-    }))
-    writeFileSync(join(physical, 'index.js'), 'export const linked = true\n')
-    symlinkSync(physical, join(appDir, 'node_modules', 'linked-esm'), 'junction')
-    const appManifest = JSON.parse(readFileSync(anchor, 'utf8')) as { dependencies: Record<string, string> }
-    appManifest.dependencies['linked-esm'] = '0.0.0'
-    writeFileSync(anchor, JSON.stringify(appManifest))
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      const home = tmp()
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      const proxyManifest = JSON.parse(readFileSync(
-        join(home, 'profiles', 'node_modules', 'linked-esm', 'package.json'),
-        'utf8',
-      )) as { dsh: { moduleFallback: { targets: Record<string, string> } } }
-      expect(proxyManifest.dsh.moduleFallback.targets['.']).toContain('/app/node_modules/linked-esm/index.js')
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    const home = tmp()
+    const resolution = await createRuntimeResolution({ installAnchor: anchor, home })
+    await expect(importFromResolution(resolution, 'bundle-a/mini')).resolves.toMatchObject({ mini: true })
+    await expect(importFromResolution(resolution, 'bundle-a/web')).resolves.toMatchObject({ web: true })
   })
 
   it('uses the legacy index fallback when a package has no exports or main', async () => {
@@ -901,15 +614,9 @@ describe('healProfilesModuleFallback', () => {
     const manifest = JSON.parse(readFileSync(join(bundleDir, 'package.json'), 'utf8')) as Record<string, unknown>
     delete manifest.main
     writeFileSync(join(bundleDir, 'package.json'), JSON.stringify(manifest))
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      const home = tmp()
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      await expect(import(join(home, 'profiles', 'node_modules', 'bundle-a', 'entry-0.js')))
-        .resolves.toMatchObject({ packageName: 'bundle-a' })
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    const home = tmp()
+    const resolution = await createRuntimeResolution({ installAnchor: anchor, home })
+    await expect(importFromResolution(resolution, 'bundle-a')).resolves.toMatchObject({ packageName: 'bundle-a' })
   })
 
   it('uses Node legacy resolution for an extensionless main entry', async () => {
@@ -918,37 +625,9 @@ describe('healProfilesModuleFallback', () => {
     const manifest = JSON.parse(readFileSync(join(bundleDir, 'package.json'), 'utf8')) as Record<string, unknown>
     manifest.main = './index'
     writeFileSync(join(bundleDir, 'package.json'), JSON.stringify(manifest))
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      const home = tmp()
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      await expect(import(join(home, 'profiles', 'node_modules', 'bundle-a', 'entry-0.js')))
-        .resolves.toMatchObject({ packageName: 'bundle-a' })
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
-  })
-
-  it('skips executable-only and declaration-only packages without import entries', async () => {
-    for (const marker of ['bin', 'types', 'typings']) {
-      const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
-      const manifest = JSON.parse(readFileSync(anchor, 'utf8')) as Record<string, unknown>
-      delete manifest.main
-      manifest[marker] = marker === 'bin' ? { dsh: './lib/bin.js' } : './index.d.ts'
-      if (marker === 'types') manifest.main = ''
-      writeFileSync(anchor, JSON.stringify(manifest))
-      rmSync(join(anchor, '..', 'index.js'))
-      Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-      try {
-        const home = tmp()
-        await healProfilesModuleFallback({ installAnchor: anchor, home })
-        const fallback = join(home, 'profiles', 'node_modules')
-        expect(existsSync(join(fallback, 'dsh-app'))).toBe(false)
-        expect(existsSync(join(fallback, 'bundle-a', 'entry-0.js'))).toBe(true)
-      } finally {
-        delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-      }
-    }
+    const home = tmp()
+    const resolution = await createRuntimeResolution({ installAnchor: anchor, home })
+    await expect(importFromResolution(resolution, 'bundle-a')).resolves.toMatchObject({ packageName: 'bundle-a' })
   })
 
   it('fails loud on a missing legacy main entry', async () => {
@@ -958,15 +637,11 @@ describe('healProfilesModuleFallback', () => {
     delete manifest.main
     writeFileSync(join(bundleDir, 'package.json'), JSON.stringify(manifest))
     rmSync(join(bundleDir, 'index.js'))
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await expect(healProfilesModuleFallback({ installAnchor: anchor, home: tmp() })).rejects.toThrow('main entry is missing')
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    const resolution = await createRuntimeResolution({ installAnchor: anchor, home: tmp() })
+    await expect(importFromResolution(resolution, 'bundle-a')).rejects.toMatchObject({ code: 'ERR_MODULE_NOT_FOUND' })
   })
 
-  it('omits unavailable ESM exports and rejects malformed export targets', async () => {
+  it('preserves native ESM export errors and null-map legacy resolution', async () => {
     for (const mode of ['missing', 'directory', 'absent-map', 'invalid', 'escape', 'null', 'null-subpath']) {
       const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
       const bundleDir = join(anchor, '..', 'node_modules', 'bundle-a')
@@ -980,97 +655,84 @@ describe('healProfilesModuleFallback', () => {
           : { '.': mode === 'null' ? null : { import: target } }
       writeFileSync(join(bundleDir, 'package.json'), JSON.stringify(manifest))
       if (mode === 'directory') mkdirSync(join(bundleDir, 'mini'))
-      Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-      try {
-        const home = tmp()
-        if (mode === 'missing' || mode === 'directory' || mode === 'absent-map') {
-          await healProfilesModuleFallback({ installAnchor: anchor, home })
-          expect(existsSync(join(home, 'profiles', 'node_modules', 'bundle-a'))).toBe(false)
-        } else {
-          await expect(healProfilesModuleFallback({ installAnchor: anchor, home })).rejects.toThrow(
-            mode === 'null' || mode === 'null-subpath'
-              ? 'cannot resolve ESM export bundle-a'
-              : 'resolves outside its package',
-          )
-        }
-      } finally {
-        delete (process as NodeJS.Process & { pkg?: unknown }).pkg
+      const home = tmp()
+      const resolution = await createRuntimeResolution({ installAnchor: anchor, home })
+      if (mode === 'absent-map') {
+        await expect(importFromResolution(resolution, 'bundle-a')).resolves.toMatchObject({ packageName: 'bundle-a' })
+      } else {
+        const specifier = mode === 'null-subpath' ? 'bundle-a/bad' : 'bundle-a'
+        const code = mode === 'missing' ? 'ERR_MODULE_NOT_FOUND'
+          : mode === 'directory' ? 'ERR_UNSUPPORTED_DIR_IMPORT'
+            : mode === 'null' || mode === 'null-subpath' ? 'ERR_PACKAGE_PATH_NOT_EXPORTED'
+              : 'ERR_INVALID_PACKAGE_TARGET'
+        await expect(importFromResolution(resolution, specifier)).rejects.toMatchObject({ code })
       }
     }
   })
+})
 
-  it('requires a package version before writing a packaged proxy', async () => {
-    const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
-    const bundleDir = join(anchor, '..', 'node_modules', 'bundle-a')
-    const manifest = JSON.parse(readFileSync(join(bundleDir, 'package.json'), 'utf8')) as Record<string, unknown>
-    manifest.version = ''
-    writeFileSync(join(bundleDir, 'package.json'), JSON.stringify(manifest))
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await expect(healProfilesModuleFallback({ installAnchor: anchor, home: tmp() })).rejects.toThrow(
-        'installed package bundle-a must declare a non-empty version',
-      )
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
-  })
+describe('removeLinkProjections', () => {
+  const link = (target: string, path: string): void => {
+    mkdirSync(dirname(path), { recursive: true })
+    symlinkSync(target, path, process.platform === 'win32' ? 'junction' : 'dir')
+  }
+  const packageAt = (dir: string, name: string, version: string): void => {
+    mkdirSync(dir, { recursive: true })
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name, version }))
+  }
 
-  it('replaces plain-node links and stale managed proxies in packaged mode', async () => {
-    const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
+  it('removes only the symlinks that point into .dsh-module-fallback and the directory itself', () => {
     const home = tmp()
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    const proxy = join(home, 'profiles', 'node_modules', 'bundle-a')
-    expect(lstatSync(proxy).isSymbolicLink()).toBe(true)
+    const profile = join(home, 'profiles', 'web')
+    const modules = join(profile, 'node_modules')
+    const owned = join(profile, '.dsh-module-fallback', 'node_modules')
+    packageAt(join(modules, 'my-bundle'), 'my-bundle', '1.0.0')
+    packageAt(join(modules, 'my-bundle', 'node_modules', 'bridge'), 'bridge', '1.0.0')
+    packageAt(join(modules, '@scope', 'helper'), '@scope/helper', '1.0.0')
+    const outside = join(home, 'workspace', 'linked-plugin')
+    packageAt(outside, 'linked-plugin', '1.0.0')
+    link(outside, join(modules, 'linked-plugin'))
+    link(join(modules, 'my-bundle', 'node_modules', 'bridge'), join(owned, 'bridge'))
+    link(join(owned, 'bridge'), join(modules, 'bridge'))
+    link(join(modules, '@scope', 'helper'), join(owned, '@scope', 'tool'))
+    link(join(owned, '@scope', 'tool'), join(modules, '@scope', 'tool'))
+    link(join(home, 'missing-target'), join(modules, 'dangling'))
+
+    removeLinkProjections(profile)
 
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      expect(lstatSync(proxy).isDirectory()).toBe(true)
-      const stale = JSON.parse(readFileSync(join(proxy, 'package.json'), 'utf8')) as {
-        version: string
-      }
-      stale.version = 'stale'
-      writeFileSync(join(proxy, 'package.json'), JSON.stringify(stale))
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      expect(JSON.parse(readFileSync(join(proxy, 'package.json'), 'utf8'))).toMatchObject({
-        version: '0.0.0',
-      })
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    expect(existsSync(join(profile, '.dsh-module-fallback'))).toBe(false)
+    expect(lstatSync(join(modules, 'bridge'), { throwIfNoEntry: false })).toBeUndefined()
+    expect(lstatSync(join(modules, '@scope', 'tool'), { throwIfNoEntry: false })).toBeUndefined()
+    expect(lstatSync(join(modules, 'my-bundle')).isDirectory()).toBe(true)
+    expect(existsSync(join(modules, 'my-bundle', 'node_modules', 'bridge', 'package.json'))).toBe(true)
+    expect(lstatSync(join(modules, '@scope', 'helper')).isDirectory()).toBe(true)
+    expect(lstatSync(join(modules, 'linked-plugin')).isSymbolicLink()).toBe(true)
+    expect(readlinkSync(join(modules, 'linked-plugin'))).toBe(outside)
+    expect(lstatSync(join(modules, 'dangling')).isSymbolicLink()).toBe(true)
+    expect(() => { removeLinkProjections(profile) }).not.toThrow()
   })
 
-  it('replaces a managed packaged proxy with a plain-node symlink', async () => {
-    const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
+  it('removes the directory when the profile has no node_modules and keeps links whose target parent is gone', () => {
     const home = tmp()
-    const fallback = join(home, 'profiles', 'node_modules', 'bundle-a')
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      await healProfilesModuleFallback({ installAnchor: anchor, home })
-      expect(lstatSync(fallback).isDirectory()).toBe(true)
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+    const profile = join(home, 'profiles', 'web')
+    mkdirSync(join(profile, '.dsh-module-fallback', 'node_modules'), { recursive: true })
+    removeLinkProjections(profile)
+    expect(existsSync(join(profile, '.dsh-module-fallback'))).toBe(false)
 
-    await healProfilesModuleFallback({ installAnchor: anchor, home })
-    expect(lstatSync(fallback).isSymbolicLink()).toBe(true)
+    const other = join(home, 'profiles', 'other')
+    mkdirSync(join(other, '.dsh-module-fallback', 'node_modules'), { recursive: true })
+    link(join(home, 'missing-parent', 'pkg'), join(other, 'node_modules', 'orphan'))
+    removeLinkProjections(other)
+    expect(existsSync(join(other, '.dsh-module-fallback'))).toBe(false)
+    expect(lstatSync(join(other, 'node_modules', 'orphan')).isSymbolicLink()).toBe(true)
   })
 
-  it('rejects foreign packaged fallback directories with valid or invalid metadata', async () => {
-    const anchor = stageInstallation({ 'bundle-a': { patch: '[]\n' } })
-    Object.defineProperty(process, 'pkg', { configurable: true, value: {} })
-    try {
-      for (const metadata of ['{}', '{']) {
-        const home = tmp()
-        const proxy = join(home, 'profiles', 'node_modules', 'bundle-a')
-        mkdirSync(proxy, { recursive: true })
-        writeFileSync(join(proxy, 'package.json'), metadata)
-        await expect(healProfilesModuleFallback({ installAnchor: anchor, home })).rejects.toThrow(
-          'exists and is not a dsh-managed module proxy',
-        )
-      }
-    } finally {
-      delete (process as NodeJS.Process & { pkg?: unknown }).pkg
-    }
+  it('leaves a profile without the directory untouched', () => {
+    const home = tmp()
+    const profile = join(home, 'profiles', 'web')
+    packageAt(join(profile, 'node_modules', 'my-plugin'), 'my-plugin', '1.0.0')
+    removeLinkProjections(profile)
+    removeLinkProjections(join(home, 'profiles', 'absent'))
+    expect(existsSync(join(profile, 'node_modules', 'my-plugin', 'package.json'))).toBe(true)
   })
 })
diff --git a/packages/boot/app-boot/tsconfig.json b/packages/boot/app-boot/tsconfig.json
index a7a959aaaf..c1e709f660 100644
--- a/packages/boot/app-boot/tsconfig.json
+++ b/packages/boot/app-boot/tsconfig.json
@@ -23,9 +23,6 @@
     {
       "path": "../../core/system-prompt"
     },
-    {
-      "path": "../../util/atomic-write"
-    },
     {
       "path": "../../util/launch-environment"
     },
diff --git a/packages/client/AGENTS.md b/packages/client/AGENTS.md
index 327c175776..1a729d3fa5 100644
--- a/packages/client/AGENTS.md
+++ b/packages/client/AGENTS.md
@@ -138,7 +138,7 @@ If `test:gui` is red on code you did not touch, neither silently fix nor ignore
 Bringing up a new `packages/client/<name>` plugin package (ui-workspace is a complete example; ui-sidebar/ui-user-questions are minimal skeletons):
 
 1. **Package skeleton**: `package.json` (`@deepseek-ai/dsh-client-<name>`, exports `.`/`./client`/`./src/*`/`./package.json`, optional `./invariant` only for an independent runtime relationship, `dsh.client` manifest, `files` list), `tsconfig.json` (extends `tsconfig.base.client.json`, one `references` entry per workspace dependency), `tsdown.config.ts` (`clientBundle(id, ['lib/types/index.js'])`, plus `lib/types/invariant.js` only when published), `src/index.ts` (empty node-half apply), optional `src/invariant.ts`, `src/css-modules.d.ts` when using CSS Modules, and `README.md` with the Model Experience section and the reason when no invariant is published.
-2. **Three registration surfaces, all required** (missing any one fails at a different, later point): the `tsconfig.client.json` aggregate `references` entry; a `dsh.client` row in `packages/bundle/web-app/cordis.patch.yml`; a `packages/bundle/web-app/package.json` dependency (profile boots resolve bare row names through the computed profile resolution generation, which the default link mode materializes on disk — a row whose package no manifest declares fails to import). `pnpm-workspace.yaml` already globs `packages/*/*`.
+2. **Three registration surfaces, all required** (missing any one fails at a different, later point): the `tsconfig.client.json` aggregate `references` entry; a `dsh.client` row in `packages/bundle/web-app/cordis.patch.yml`; a `packages/bundle/web-app/package.json` dependency (profile boots resolve bare row names through the computed runtime resolution, which is installed as an interception on Node's resolvers — a row whose package no manifest declares fails to import). `pnpm-workspace.yaml` already globs `packages/*/*`.
 3. **dsh.client manifest semantics**: `platform: 'web'` always, and the declaration requires a `./client` export (the scan throws without one); `immediately: true` only for stage-one-prefetch infrastructure rows. `inject` lists package-name dependency edges — they are **informational only** (preflight display, HMR diffing); they do not sequence entry activation or apply order. Activation order is Cordis fiber inject waiting on *services*, nothing else. A non-baseline `external` request sequences its dynamic supplier ahead of the consumer — see [shared modules](#shared-modules-and-the-module-graph).
 4. **Registering into another package's slot**: apply order is unconstrained, and a business service is not a declaration barrier. Use `ctx.slots.inject(name, () => ctx.slots.register(...))`; it waits on the actual declaration, removes the contribution when that declaration collapses, reruns after redeclaration, and leaves with the caller's plugin fiber. Return a generator yielding each registration when several contributions must install and roll back atomically. A bare `slots.register` into an undeclared slot remains an error; keep service edges only for services the contribution actually reads.
 5. Rebuild the bundle (`pnpm --filter <pkg> bundle`) before probing a live `dsh web` server — the registry serves `lib/client.js`, not sources.
diff --git a/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.module.css b/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.module.css
index df6fa638fd..25530eef99 100644
--- a/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.module.css
+++ b/packages/client/ui-conversation/src/client/skeleton/ConversationRoot.module.css
@@ -47,14 +47,13 @@
   min-height: 0;
 }
 
-/* macOS hiddenInset titlebar: the title row doubles as the window drag
-   region; interactive children opt out. */
-:global([data-platform='darwin']) .titleRow {
-  -webkit-app-region: drag;
-}
-
-:global([data-platform='darwin']) .titleRow button,
-:global([data-platform='darwin']) .titleRow a,
+/* macOS hiddenInset titlebar: window dragging comes from ui-layout's
+   .leadingBand (the frame's first child), never from this header. Electron
+   composes app-regions in document order ignoring stacking, so a drag rule
+   here would keep eating clicks through overlays mounted earlier in the DOM
+   (the settings modal lives in the sidebar column). The title-row clusters
+   overlap the band and subtract their whole boxes; individual controls are
+   covered by the base.css interactive-element rule. */
 :global([data-platform='darwin']) .headerLeading,
 :global([data-platform='darwin']) .headerActions,
 :global([data-platform='darwin']) .headerUtilities,
@@ -68,6 +67,11 @@
   align-items: center;
   gap: 0;
   min-height: 30px;
+  /* Clears the frame's window-chrome band (traffic lights + shell.leading
+     controls, ui-layout AppFrame) when it is published; the header already
+     pads 20px of it. Zero everywhere else (the fallback makes the max
+     negative). */
+  padding-inline-start: max(0px, calc(var(--dsh-frame-leading-clearance, 0px) - 20px));
 }
 
 .titleCluster {
@@ -113,6 +117,7 @@
 }
 
 .crumb {
+  display: inline-block;
   max-width: 220px;
   overflow: hidden;
   padding: 4px 8px;
@@ -132,7 +137,7 @@
   line-height: 18px;
 }
 
-.crumb:hover:not(:disabled) {
+button.crumb:hover {
   background: var(--dsw-alias-interactive-bg-hover);
 }
 
diff --git a/packages/client/ui-conversation/src/client/skeleton/ConversationSession.tsx b/packages/client/ui-conversation/src/client/skeleton/ConversationSession.tsx
index 0294b75b10..d17f52e3f8 100644
--- a/packages/client/ui-conversation/src/client/skeleton/ConversationSession.tsx
+++ b/packages/client/ui-conversation/src/client/skeleton/ConversationSession.tsx
@@ -73,20 +73,25 @@ export function ConversationSessionHeader({
               <nav className={css.crumbs} aria-label={t('session.hierarchy')}>
                 {ancestry.map((summary, index) => {
                   const last = index === ancestry.length - 1
-                  const title = (
-                    <button
-                      type="button"
-                      className={clsx(
-                        css.crumb,
-                        summary.subagent && css.crumbSubagent,
-                        last && css.crumbCurrent,
-                      )}
-                      disabled={last}
-                      onClick={() => { open(summary.id) }}
-                    >
-                      {summary.displayTitle}
-                    </button>
-                  )
+                  // The current crumb has no navigation, so it is plain text
+                  // rather than a disabled button: on darwin desktop a button
+                  // would subtract itself from the window drag band (ui-web
+                  // base.css) and leave the title inert for dragging too.
+                  const title = last
+                    ? (
+                      <span className={clsx(css.crumb, summary.subagent && css.crumbSubagent, css.crumbCurrent)}>
+                        {summary.displayTitle}
+                      </span>
+                    )
+                    : (
+                      <button
+                        type="button"
+                        className={clsx(css.crumb, summary.subagent && css.crumbSubagent)}
+                        onClick={() => { open(summary.id) }}
+                      >
+                        {summary.displayTitle}
+                      </button>
+                    )
                   const lineage = last || summary.subagent
                   const lineageOwner = {
                     lineageSessionId: summary.id,
@@ -133,7 +138,9 @@ export function ConversationSessionHeader({
         </div>
       </div>
       {showTabs && (
-        <div className={css.tabs} role="tablist">
+        // data-conversation-tabs: ui-layout's window drag band matches this
+        // marker (:has) to deepen only while the tab strip adds header height.
+        <div className={css.tabs} role="tablist" data-conversation-tabs="">
           {tabs.map(viewTab => (
             <button
               key={viewTab.id}
diff --git a/packages/client/ui-conversation/tests/assembly-surfaces.client.spec.tsx b/packages/client/ui-conversation/tests/assembly-surfaces.client.spec.tsx
index ac4bcd48de..84e5ba28a1 100644
--- a/packages/client/ui-conversation/tests/assembly-surfaces.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/assembly-surfaces.client.spec.tsx
@@ -244,13 +244,13 @@ describe('title projection across assembled surfaces', () => {
     const runtime = await bench()
     const view = runtime.renderRoot()
     const hierarchy = view.getByRole('navigation', { name: '会话层级' })
-    expect(within(hierarchy).getByRole('button', { name: 'S' }).hasAttribute('disabled')).toBe(true)
+    expect(within(hierarchy).getByText('S').tagName).toBe('SPAN')
 
     await runtime.sessions.updateSummary(SID, { displayTitle: '修订标题', title: '修订标题' })
     await waitFor(() => {
-      expect(within(hierarchy).getByRole('button', { name: '修订标题' }).hasAttribute('disabled')).toBe(true)
+      expect(within(hierarchy).getByText('修订标题').tagName).toBe('SPAN')
     })
-    expect(within(hierarchy).queryByRole('button', { name: 'S' })).toBeNull()
+    expect(within(hierarchy).queryByText('S')).toBeNull()
     await runtime.dispose()
   })
 })
diff --git a/packages/client/ui-conversation/tests/skeleton.client.spec.tsx b/packages/client/ui-conversation/tests/skeleton.client.spec.tsx
index edc7c47d7b..17aadfb056 100644
--- a/packages/client/ui-conversation/tests/skeleton.client.spec.tsx
+++ b/packages/client/ui-conversation/tests/skeleton.client.spec.tsx
@@ -468,14 +468,17 @@ describe('ConversationRoot resident composer', () => {
     expect(b.store.store.getSnapshot().draft).toBe('ordinary revised')
     fireEvent.keyDown(box, { key: 'Enter' })
     expect(b.sink).toHaveBeenCalledWith('ordinary revised', [], 'queue', expect.any(AbortSignal))
-    expect((b.view.getByRole('button', { name: 'Child' }) as HTMLButtonElement).disabled).toBe(true)
+    // The current crumb is plain text (a drag surface on darwin), not a button.
+    expect(b.view.queryByRole('button', { name: 'Child' })).toBeNull()
+    expect(b.view.getByText('Child').tagName).toBe('SPAN')
     expect(b.view.queryByText('Root')).toBeNull()
   })
 
   it('shows hierarchy only for subagents and opens their ordinary owner', () => {
     const b = mount(sessionSnapshotOf(), undefined, undefined, { summaryOrigin: 'subagent' })
     const root = b.view.getByRole('button', { name: 'Root' })
-    expect((b.view.getByRole('button', { name: 'Child' }) as HTMLButtonElement).disabled).toBe(true)
+    expect(b.view.queryByRole('button', { name: 'Child' })).toBeNull()
+    expect(b.view.getByText('Child').tagName).toBe('SPAN')
     fireEvent.click(root)
     expect(b.open).toHaveBeenCalledWith(sid('root'))
   })
@@ -487,7 +490,7 @@ describe('ConversationRoot resident composer', () => {
     })
     expect(b.view.getByRole('button', { name: 'Root' }).className).not.toContain('crumbSubagent')
     expect(b.view.getByRole('button', { name: 'Parent' }).className).toContain('crumbSubagent')
-    expect(b.view.getByRole('button', { name: 'Child' }).className).toContain('crumbSubagent')
+    expect(b.view.getByText('Child').className).toContain('crumbSubagent')
     expect(b.lineageOwners.slice(-2).map(owner => owner.lineageSessionId)).toEqual([
       sid('parent'),
       SID,
@@ -648,6 +651,8 @@ describe('ConversationRoot resident composer', () => {
     expect(b.view.queryByTestId('view-new-view')).toBeNull()
     expect(b.view.getByRole('tab', { name: 'Chat' }).getAttribute('aria-selected')).toBe('true')
     expect(b.view.getByRole('tab', { name: 'New view' }).getAttribute('aria-selected')).toBe('false')
+    // ui-layout's window drag band deepens by matching this marker (:has).
+    expect(b.view.getByRole('tablist').hasAttribute('data-conversation-tabs')).toBe(true)
   })
 
   it('rolls the pending workspace label back when switching fails', async () => {
diff --git a/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx b/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx
index 1aed3a8d2a..11f6083a2a 100644
--- a/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx
+++ b/packages/client/ui-directory-picker-native/tests/client-flow.client.spec.tsx
@@ -20,7 +20,7 @@ vi.mock(desktopIpc.electron, () => ({
   ipcRenderer: { invoke: desktopIpc.invoke },
   contextBridge: { exposeInMainWorld: (name: string, value: unknown) => { vi.stubGlobal(name, value) } },
 }))
-vi.mock('../../../../apps/desktop/src/preload-platform.ts', () => ({ markDocumentPlatform: vi.fn() }))
+vi.mock('../../../../apps/desktop/src/preload-platform.ts', () => ({ markDocumentPlatform: vi.fn(), syncWindowFullscreen: vi.fn() }))
 vi.mock('../../../../apps/desktop/src/preload-theme.ts', () => ({ syncNativeTheme: vi.fn() }))
 vi.mock('../../../../apps/desktop/src/preload-windows.ts', () => ({ syncWindowsAppearance: vi.fn() }))
 
diff --git a/packages/client/ui-dockkit/src/components/dockkit.module.css b/packages/client/ui-dockkit/src/components/dockkit.module.css
index 55279ecbe1..fab875c5b6 100644
--- a/packages/client/ui-dockkit/src/components/dockkit.module.css
+++ b/packages/client/ui-dockkit/src/components/dockkit.module.css
@@ -221,6 +221,23 @@
   margin-left: 4px;
 }
 
+/* macOS desktop: an embedder may pin this surface under the window's top drag
+   band (ui-layout .leadingBand — full-window geometry that Electron composes
+   in DOM order, not by stacking). The chip run, the strip-end chrome, the
+   pane body, and the split divider subtract their whole boxes so tabs,
+   controls, content, and the resize grab stay usable even where they overlap
+   the band; the strip's blank fill and top inset keep the band's drag, so the
+   row moves the window like a native tab bar. The divider must be named here:
+   it is a plain div, so ui-web base.css's interactive-element subtraction
+   never matches it. Hidden surfaces contribute nothing: Blink skips
+   non-visible boxes when it collects draggable regions. */
+:global(html[data-platform='darwin']) .stripTabs,
+:global(html[data-platform='darwin']) .stripChrome,
+:global(html[data-platform='darwin']) .paneBody,
+:global(html[data-platform='darwin']) .divider {
+  -webkit-app-region: no-drag;
+}
+
 /* The slot between two chips: a 10px box with a hairline down its centre.
    Targeted by a drag, the same box draws the caret instead, so the chips
    around it never move. */
diff --git a/packages/client/ui-dockkit/tests/app-region-styles.client.spec.ts b/packages/client/ui-dockkit/tests/app-region-styles.client.spec.ts
new file mode 100644
index 0000000000..4793b7e617
--- /dev/null
+++ b/packages/client/ui-dockkit/tests/app-region-styles.client.spec.ts
@@ -0,0 +1,28 @@
+/**
+ * macOS drag-band subtraction, asserted against dockkit.module.css on disk:
+ * an embedder may pin the surface under the window's top drag band, and
+ * Electron composes app-regions from geometry in DOM order — every box that
+ * must stay usable subtracts itself. The divider must be listed explicitly:
+ * it is a plain div, so ui-web base.css's interactive-element subtraction
+ * never matches it, and an unsubtracted vertical divider's top run would
+ * drag the window instead of resizing the split.
+ */
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const css = readFileSync(resolve(import.meta.dirname, '../src/components/dockkit.module.css'), 'utf8')
+
+describe('macOS app-region subtraction', () => {
+  it('subtracts the chip run, strip-end chrome, pane body, and divider; never declares drag', () => {
+    const rules = [...css.matchAll(/(?<sel>[^{}]+)\{(?<body>[^{}]*)\}/g)]
+      .map(match => [match.groups!['sel']!.trim(), match.groups!['body']!] as const)
+      .filter(([, body]) => body.includes('-webkit-app-region'))
+    expect(rules).toHaveLength(1)
+    const [selector, body] = rules[0]!
+    expect(/-webkit-app-region:\s*([^;]+);/.exec(body)?.[1]?.trim()).toBe('no-drag')
+    for (const part of ['.stripTabs', '.stripChrome', '.paneBody', '.divider']) {
+      expect(selector, part).toContain(`:global(html[data-platform='darwin']) ${part}`)
+    }
+  })
+})
diff --git a/packages/client/ui-input-trigger/src/client/MenuView.tsx b/packages/client/ui-input-trigger/src/client/MenuView.tsx
index a6395aff8b..92897cb66d 100644
--- a/packages/client/ui-input-trigger/src/client/MenuView.tsx
+++ b/packages/client/ui-input-trigger/src/client/MenuView.tsx
@@ -26,6 +26,13 @@ export type MenuViewProps = MenuViewInjected & PropsLocale<'slash.menu'>
 /** Height cap that fits the two headings and eight built-in command rows. */
 const MAX_HEIGHT = 400
 
+/**
+ * Viewport top margin: the conversation header's 76px block (title row plus
+ * view tabs, ui-conversation) plus 8px of air, so a tall list stops below the
+ * header instead of sliding under it.
+ */
+const TOP_MARGIN = 84
+
 /** DOM id of one option row (the aria-activedescendant target). */
 function optionId(source: string, index: number): string {
   return `dsh-slash-option-${source}-${index}`
@@ -51,7 +58,7 @@ export function MenuView({ menu, headers, onPick, onCrumb, onHover, onDismiss, t
   // The list is bottom-anchored above the composer; clamp the design cap to
   // the space above it, re-measured on every store update (the anchor moves
   // when the composer grows).
-  const maxHeight = useAnchoredMaxHeight(listRef, MAX_HEIGHT, state)
+  const maxHeight = useAnchoredMaxHeight(listRef, MAX_HEIGHT, state, TOP_MARGIN)
   const updateOverflowHint = useCallback(() => {
     const viewport = viewportRef.current
     setHasOverflowBelow(viewport !== null
diff --git a/packages/client/ui-input-trigger/tests/menu-view.client.spec.tsx b/packages/client/ui-input-trigger/tests/menu-view.client.spec.tsx
index db4697ad90..07342988f9 100644
--- a/packages/client/ui-input-trigger/tests/menu-view.client.spec.tsx
+++ b/packages/client/ui-input-trigger/tests/menu-view.client.spec.tsx
@@ -241,10 +241,10 @@ describe('MenuView', () => {
     expect(menuShell().style.maxHeight).toBe('400px')
   })
 
-  it('clamps the list height to the space above the composer minus the safe margin', () => {
+  it('clamps the list height to the space above the composer minus the header-clearing margin', () => {
     vi.spyOn(Element.prototype, 'getBoundingClientRect').mockReturnValue({ bottom: 200 } as DOMRect)
     mount(openState())
-    expect(menuShell().style.maxHeight).toBe('188px')
+    expect(menuShell().style.maxHeight).toBe('116px')
   })
 
   it('re-fits the height when the window resizes', () => {
@@ -254,7 +254,7 @@ describe('MenuView', () => {
     expect(menuShell().style.maxHeight).toBe('400px')
     rect.mockReturnValue({ bottom: 100 } as DOMRect)
     act(() => { window.dispatchEvent(new Event('resize')) })
-    expect(menuShell().style.maxHeight).toBe('88px')
+    expect(menuShell().style.maxHeight).toBe('16px')
   })
 
   it('shows the bottom overflow hint until the list reaches its final row', () => {
diff --git a/packages/client/ui-layout/README.i18n.yaml b/packages/client/ui-layout/README.i18n.yaml
index 07dc90eb4c..57e2a79c7a 100644
--- a/packages/client/ui-layout/README.i18n.yaml
+++ b/packages/client/ui-layout/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-layout/README.md
-README.md: 582c5fbea271caf0f45f9ee22c10d21f7412bf38
-README.zh.md: 14e3f429284c5c3a519fa47e1156a510b7271f91
+README.md: b26b182f5ea2c727411910cc5f85819b9dfbcb2c
+README.zh.md: 58ef066ab05389898dc912500cd6b37f1a07824d
diff --git a/packages/client/ui-layout/README.md b/packages/client/ui-layout/README.md
index 582c5fbea2..b26b182f5e 100644
--- a/packages/client/ui-layout/README.md
+++ b/packages/client/ui-layout/README.md
@@ -29,6 +29,10 @@ The root slot composes the sidebar, main content, and right column. The sidebar
 
 Global panels occupy the root-scoped `main` keyed slot; `conversation` is the reserved key for the Conversation. `ctx.layout.selectPanel(id)` selects a registered panel, and `null` selects the Conversation without changing the current Session. No global panel is registered by the shipped composition.
 
+### Window-chrome seat
+
+On macOS desktop (`html[data-platform='darwin']`, set only by the desktop preload) a collapsed sidebar hides its column entirely instead of keeping the rail, and the frame mounts the single root-scoped `shell.leading` seat at its top-left — beside the hiddenInset traffic lights, over every main panel; ui-sidebar occupies it with the reopen and New Session controls. While the seat is mounted the frame publishes `--dsh-frame-leading-clearance`, the inline band the window chrome occupies measured from the frame's left edge; a main panel whose content reaches the top-left corner pads by it so nothing lands under the lights or the controls. The frame also always publishes `--dsh-frame-top-clearance` (48px) on the root element, the constant step below the window's top strip; entry pages in the main panel (plugin manager and similar, not the conversation) pad their top by it, and overlay primitives (portal menus, bottom-anchored overlays, the settings panel) keep it as their top viewport margin — the root-element home lets overlays portalled to `document.body` read it too. The full-width window drag band is 52px; while the Conversation is selected and its header shows the view tab strip, the band deepens to the 76px header block (title row plus tab strip), so blank header space drags while header controls stay clickable.
+
 Windows Electron's `data-windows-titlebar` marker reserves the caption height above all columns and removes the collapsed sidebar rail. Only the content area's top-left corner has a 16px radius; the other corners and the internal divider remain square. The frame publishes `--dsh-windows-content-radius` and `--dsh-windows-sidebar-width` for ui-sidebar-right's fullscreen corner and sidebar clearance. Ordinary Web documents do not receive the marker; macOS retains its separate layout.
 
 ### Theme presentation
@@ -45,7 +49,7 @@ The presenter consumes resolved theme snapshots and projects them onto the docum
 
 `selectPanel(id)` checks the live `main` registry before changing selection; an absent key throws and leaves the current panel intact. `beginNavigation()` returns an abort signal for an asynchronous UI navigation. A later call, a valid panel selection (including repeated selection), or layout disposal aborts that signal without cancelling underlying Session creation. Consumers check the signal before committing navigation or moving drafts.
 
-One registration declares four child slots and binds `ctx.layout` methods `selectPanel`, `toggleSidebar`, `openRightbar(track, fullscreen)`, and `closeRightbar`. One root store separates `panelInfo` selection from `layoutInfo` measurements, width preferences, and presentation reports. `usePanelInfo` subscribes to the stable selection object; AppFrame subscribes to the stable layout object. The `rightbar` owner supplies actual `width`, `viewportWidth`, and normal-presentation eligibility `canShow`; insufficient room causes a deterministic close, never automatic reopening on widening. Fullscreen hides the width handle without releasing a track the occupant retains. AppFrame keeps the column containers mounted. The right column's root controller renders `rightbar.session` through `SessionProvider` only while the Conversation is selected; its unmount report releases the track. The independent title component uses the selected Session title only while the Conversation is visible, with the build-configured product title or localized `common.brand.localBuild` as its fallback; locale revisions update that fallback. The theme presenter is a second effect: pure DOM writes from resolved snapshots — initial state through the getter once, then event-driven only, with no React path. It applies palette, font-size, and token variables before measuring the rendered background as the single color authority. Fullscreen presentation suppresses grid and handle transitions; its occupant reports the new columns only after covering the frame. Fullscreen exit keeps transitions suppressed while the frame installs its destination geometry: close removes the right track, and restore retains it. Subsequent normal geometry actions restore ordinary transitions.
+One registration declares five child slots and binds `ctx.layout` methods `selectPanel`, `toggleSidebar`, `openRightbar(track, fullscreen)`, and `closeRightbar`. One root store separates `panelInfo` selection from `layoutInfo` measurements, width preferences, and presentation reports. `usePanelInfo` subscribes to the stable selection object; AppFrame subscribes to the stable layout object. The `rightbar` owner supplies actual `width`, `viewportWidth`, and normal-presentation eligibility `canShow`; insufficient room causes a deterministic close, never automatic reopening on widening. Fullscreen hides the width handle without releasing a track the occupant retains. AppFrame keeps the column containers mounted. The right column's root controller renders `rightbar.session` through `SessionProvider` only while the Conversation is selected; its unmount report releases the track. The independent title component uses the selected Session title only while the Conversation is visible, with the build-configured product title or localized `common.brand.localBuild` as its fallback; locale revisions update that fallback. The theme presenter is a second effect: pure DOM writes from resolved snapshots — initial state through the getter once, then event-driven only, with no React path. It applies palette, font-size, and token variables before measuring the rendered background as the single color authority. Fullscreen presentation suppresses grid and handle transitions; its occupant reports the new columns only after covering the frame. Fullscreen exit keeps transitions suppressed while the frame installs its destination geometry: close removes the right track, and restore retains it. Subsequent normal geometry actions restore ordinary transitions.
 
 </details>
 
@@ -82,7 +86,7 @@ These limits define the current layout behavior. They are current package constr
 
 - **Panel geometry is transient** — reload restores the sidebar default and the right panel hidden; each dragged width is one frame-wide preference, not a per-Session fact.
 - **Extremely narrow windows** — after the right panel closes, the center may still fall below 400px; the left 56px rail remains.
-- **Track and panel travel on one shared curve** — the frame's track transition and the occupant's slide read the same duration and easing variables; an occupant that used its own would detach the panel's edge from the conversation's while squeezing.
+- **Track and panel travel on one shared curve only while animating** — during a discrete open/close the frame sets `data-animating` and its track transition and the occupant's slide read the same duration and easing variables; an occupant that used its own would detach the panel's edge from the conversation's while squeezing. Drags and instant presentation switches run transition-free, so the curve does not cover them.
 - **No scroll anchoring during squeeze reflow** — layout changes may move the reader's viewport.
 
 <a id="dev-note"></a>
diff --git a/packages/client/ui-layout/README.zh.md b/packages/client/ui-layout/README.zh.md
index 14e3f42928..58ef066ab0 100644
--- a/packages/client/ui-layout/README.zh.md
+++ b/packages/client/ui-layout/README.zh.md
@@ -29,6 +29,10 @@ kind: "package-reference"
 
 全局面板占据 root 作用域的 `main` keyed slot；`conversation` 是为会话界面保留的 key。`ctx.layout.selectPanel(id)` 选中已注册面板，`null` 则选中会话界面，但不改变当前会话。默认组合不注册任何全局面板。
 
+### 窗口 chrome 座
+
+在 macOS 桌面（`html[data-platform='darwin']`，仅由桌面 preload 设置）下，收起的侧边栏整列隐藏而非保留控制栏，框架在左上角挂载 root 作用域的单一 `shell.leading` 座——位于 hiddenInset 红绿灯旁，覆盖所有主面板；ui-sidebar 以重新打开与 New Session 控件占据该座。座挂载期间框架发布 `--dsh-frame-leading-clearance`：窗口 chrome 占据的行内带宽，自框架左边缘起量；内容抵达左上角的主面板以它做内边距，避免落在红绿灯或控件之下。框架还始终在根元素上发布 `--dsh-frame-top-clearance`（48px）：窗口顶带之下的固定下沉量；主面板中的入口型页面（插件管理器等类似页面，非对话）以它做顶部内边距，浮层原语（portal 菜单、底部锚定浮层、设置面板）以它做视口顶部安全边距——放在根元素上让 portal 到 document.body 的浮层也能读到。全宽窗口拖拽带为 52px；选中会话界面且其 header 显示视图 tab 条时，加深至 76px 的 header 块（标题行加 tab 条），header 空白处可拖拽，控件保持可点。
+
 Windows Electron 的 `data-windows-titlebar` 标记在所有列上方预留顶栏高度，并移除收起后的侧栏轨道。内容区仅左上角保留 16px 圆角，其余角和内部交界处保持直角。框架发布 `--dsh-windows-content-radius` 和 `--dsh-windows-sidebar-width`，供 ui-sidebar-right 的全屏圆角及侧栏避让使用。普通 Web 文档不会获得该标记；macOS 保留其独立布局。
 
 ### 主题呈现
@@ -45,7 +49,7 @@ Windows Electron 的 `data-windows-titlebar` 标记在所有列上方预留顶
 
 `selectPanel(id)` 在改变选中态前检查实时 `main` 注册表；缺失的 key 会抛错并保留当前面板。`beginNavigation()` 为异步 UI 导航返回 abort signal。后续调用、有效面板选择（包括重复选择）或布局释放会中止该 signal，但不取消底层会话创建。消费方在提交导航或搬移草稿前检查 signal。
 
-一次注册声明四个子 slot，并绑定 `ctx.layout` 的 `selectPanel`、`toggleSidebar`、`openRightbar(track, fullscreen)` 与 `closeRightbar`。同一个 root 存储把 `panelInfo` 选中态与 `layoutInfo` 测量、宽度偏好、呈现报告分开。`usePanelInfo` 订阅引用稳定的选中态对象，AppFrame 订阅引用稳定的布局对象。`rightbar` owner 提供实际 `width`、`viewportWidth`，以及表示能否以普通模式呈现的 `canShow`；占用方在空间不足时执行确定性的收起，变宽不自行重新展开。全屏隐藏宽度手柄，但不自行释放占用方要求保留的轨道。AppFrame 保持各列容器挂载。右栏的 root 控制器仅在选中会话界面时，经 `SessionProvider` 渲染 `rightbar.session`；内容卸载时的报告释放轨道。独立的标题组件仅在会话界面可见时使用所选会话标题，以构建配置的产品标题或本地化 `common.brand.localBuild` 为回退值；语言变化会更新该回退值。主题呈现器是第二个 effect：从解析后的快照做纯 DOM 写入——初始状态经 getter 读取一次，此后仅事件驱动，不经过 React。它先应用调色板、字号与 token 变量，再把渲染出的背景测量为唯一的颜色依据。全屏呈现禁用网格和手柄过渡；占用方完全覆盖框架后才报告新的列布局。退出全屏时，框架先保持无过渡并安装目标布局：关闭移除右轨道，恢复保留右轨道。后续普通几何操作恢复正常过渡。
+一次注册声明五个子 slot，并绑定 `ctx.layout` 的 `selectPanel`、`toggleSidebar`、`openRightbar(track, fullscreen)` 与 `closeRightbar`。同一个 root 存储把 `panelInfo` 选中态与 `layoutInfo` 测量、宽度偏好、呈现报告分开。`usePanelInfo` 订阅引用稳定的选中态对象，AppFrame 订阅引用稳定的布局对象。`rightbar` owner 提供实际 `width`、`viewportWidth`，以及表示能否以普通模式呈现的 `canShow`；占用方在空间不足时执行确定性的收起，变宽不自行重新展开。全屏隐藏宽度手柄，但不自行释放占用方要求保留的轨道。AppFrame 保持各列容器挂载。右栏的 root 控制器仅在选中会话界面时，经 `SessionProvider` 渲染 `rightbar.session`；内容卸载时的报告释放轨道。独立的标题组件仅在会话界面可见时使用所选会话标题，以构建配置的产品标题或本地化 `common.brand.localBuild` 为回退值；语言变化会更新该回退值。主题呈现器是第二个 effect：从解析后的快照做纯 DOM 写入——初始状态经 getter 读取一次，此后仅事件驱动，不经过 React。它先应用调色板、字号与 token 变量，再把渲染出的背景测量为唯一的颜色依据。全屏呈现禁用网格和手柄过渡；占用方完全覆盖框架后才报告新的列布局。退出全屏时，框架先保持无过渡并安装目标布局：关闭移除右轨道，恢复保留右轨道。后续普通几何操作恢复正常过渡。
 
 </details>
 
@@ -82,7 +86,7 @@ Windows Electron 的 `data-windows-titlebar` 标记在所有列上方预留顶
 
 - **面板几何是瞬时状态**——重新加载会恢复侧栏默认值并隐藏右侧面板；拖动设置的宽度是整个框架共用的一份偏好，而非每个会话各自的属性。
 - **极窄窗口**——右侧面板关闭后，中栏仍可能小于 400px；左侧 56px 控制栏仍会保留。
-- **轨道与面板沿同一条曲线运动**——框架的轨道过渡和占用方的滑入读取同一组时长与缓动变量；占用方若自用一套，挤压时面板边缘就会与会话界面的边缘脱开。
+- **轨道与面板仅在动画期间沿同一条曲线运动**——离散开合时框架设置 `data-animating`，其轨道过渡和占用方的滑入读取同一组时长与缓动变量；占用方若自用一套，挤压时面板边缘就会与会话界面的边缘脱开。拖拽和即时呈现切换不带过渡，因此该曲线不覆盖它们。
 - **挤压重排期间无滚动锚定**——布局变化可能移动读者的视口。
 
 <a id="dev-note"></a>
diff --git a/packages/client/ui-layout/src/client/AppFrame.module.css b/packages/client/ui-layout/src/client/AppFrame.module.css
index 54dd7f368c..8983d4f7c2 100644
--- a/packages/client/ui-layout/src/client/AppFrame.module.css
+++ b/packages/client/ui-layout/src/client/AppFrame.module.css
@@ -5,8 +5,14 @@
   height: 100%;
   overflow: hidden;
   background: var(--dsw-alias-bg-base);
-  /* Collapse/expand animates the tracks on the deepsuite sider curve
-     (--ds-ease-in-out / --ds-transition-duration-slow, ui-theme base.css). */
+}
+
+/* Only a discrete collapse/expand toggle eases the tracks (the TSX holds
+   data-animating across the toggle on the deepsuite sider curve). Steady-state
+   tracks move only with the viewport, and those updates must land instantly:
+   an eased track chases the live window edge and the centre column visibly
+   rubber-bands while the user resizes the window. */
+.frame[data-animating] {
   transition: grid-template-columns var(--ds-transition-duration-slow) var(--ds-ease-in-out);
 }
 
@@ -49,7 +55,7 @@
 }
 
 @media (prefers-reduced-motion: reduce) {
-  .frame {
+  .frame[data-animating] {
     transition: none;
   }
 }
@@ -77,22 +83,148 @@
   background: transparent;
 }
 
+/* The constant step below the window's top strip (traffic lights, sidebar
+   toggle, shell.leading controls), the same in both sidebar states. Entry
+   pages in the main panel (plugin manager, settings-like pages — not the
+   conversation, which owns its header) pad their top by it so their leading
+   content clears the strip, and overlay primitives keep it as their top
+   viewport margin. Declared on the root element rather than the frame so
+   overlays portalled to document.body inherit it too. */
+:global(html[data-platform='darwin']) {
+  --dsh-frame-top-clearance: 48px;
+}
+
 :global([data-platform='darwin']) .sidebarCol {
-  background: color-mix(in srgb, var(--dsw-specific-sidebar-fill) 60%, transparent);
+  /* A blue wash over the top of the translucent tint, gone by a third of the
+     column; a faint blue-grey-violet rises through the bottom third; and a
+     faint blue cast is mixed into the tint itself. Every layer stays
+     transparent so vibrancy shows. */
+  background:
+    linear-gradient(
+      to bottom,
+      rgb(122 155 240 / 0.1),
+      rgb(122 155 240 / 0) 35%,
+      rgb(143 137 184 / 0) 68%,
+      rgb(143 137 184 / 0.09)
+    ),
+    color-mix(in srgb, color-mix(in srgb, var(--dsw-specific-sidebar-fill) 97%, rgb(122 155 240)) 40%, transparent);
   border-right: none;
 }
 
+/* Dark drops the blue cast (the light-mode wash reads purple over dark fills)
+   and thins the fill so more wallpaper shows; the washes stay. */
+:global([data-platform='darwin']) :global([data-ds-dark-theme]) .sidebarCol {
+  background:
+    linear-gradient(
+      to bottom,
+      rgb(122 155 240 / 0.08),
+      rgb(122 155 240 / 0) 35%,
+      rgb(143 137 184 / 0) 68%,
+      rgb(143 137 184 / 0.07)
+    ),
+    color-mix(in srgb, var(--dsw-specific-sidebar-fill) 50%, transparent);
+}
+
+/* macOS Reduce Transparency: the OS flattens the window's vibrancy layer to a
+   solid grey, so the thin tint and washes read washed-out over it. Replace
+   them with a 90%-opaque fill of the same token in both themes (the dark
+   selector repeats so this outranks its thinner fill). */
+@media (prefers-reduced-transparency: reduce) {
+  :global([data-platform='darwin']) .sidebarCol,
+  :global([data-platform='darwin']) :global([data-ds-dark-theme]) .sidebarCol {
+    background: color-mix(in srgb, var(--dsw-specific-sidebar-fill) 90%, transparent);
+  }
+}
+
 :global([data-platform='darwin']) .centerCol {
   background: var(--dsw-alias-bg-base);
   border-left: 0.5px solid var(--dsw-alias-border-l3);
 }
 
+/* The right track paints the base ground on the transparent frame: while the
+   track and the occupant's translateX slide ride the same curve, the grid
+   eases in layout and the transform on the compositor, so frames where they
+   diverge would otherwise show vibrancy glass between the centre's right edge
+   and the incoming panel. The occupant's opaque panel covers this at rest. */
+:global([data-platform='darwin']) .rightbarCol {
+  background: var(--dsw-alias-bg-base);
+}
+
 /* The darwin closed sidebar has no rail: the centre reaches the window edge,
    where a separator would draw a seam against nothing. */
 :global([data-platform='darwin']) [data-sidebar-collapsed] .centerCol {
   border-left: none;
 }
 
+/* Published while the shell.leading seat is mounted (same condition as the
+   TSX mount: darwin with the sidebar collapsed — the collapse that hides the
+   column entirely): the inline band the window chrome occupies, measured from
+   the frame's left edge — traffic lights to x 68, controls at x 88
+   (28 + 8 + 28), then 8px of air. Main panels whose content reaches the
+   top-left corner pad by this. */
+:global([data-platform='darwin']) .frame[data-sidebar-collapsed] {
+  --dsh-frame-leading-clearance: 160px;
+}
+
+/* Fullscreen hides the traffic lights (preload mirrors the window state onto
+   html[data-fullscreen]): the seat takes their band and the clearance keeps
+   only the controls (12 + 28 + 8 + 28 + 8). The 12px start matches the
+   expanded sidebar strip's inline padding (ui-sidebar .topStrip), so
+   collapsing never shifts the toggle. */
+:global([data-platform='darwin'][data-fullscreen]) .frame[data-sidebar-collapsed] {
+  --dsh-frame-leading-clearance: 84px;
+}
+
+:global([data-platform='darwin'][data-fullscreen]) .leadingSeat {
+  left: 12px;
+}
+
+/* The full-width window drag band (macOS desktop, always mounted): the
+   window's top strip stays draggable over every panel in both sidebar states.
+   Pointer events pass through (Electron app-regions are geometry, not hit
+   testing), and it renders as the frame's first child — before all column
+   content and overlays — so app-regions composing in document order let every
+   later no-drag (base.css's interactive-element rule, overlay boxes) subtract
+   from this band. That ordering is the drag mechanism's single invariant:
+   drag regions live only on early chrome bands like this one, never on
+   content containers, which would override earlier-mounted overlays. 52px
+   matches the sidebar top strip's height. */
+.leadingBand {
+  position: absolute;
+  top: 0;
+  right: 0;
+  left: 0;
+  height: 52px;
+  pointer-events: none;
+  -webkit-app-region: drag;
+}
+
+/* While the Conversation is the selected main panel AND its header shows the
+   view tab strip (data-conversation-tabs, ui-conversation), the band deepens
+   to the full 76px header block — title row plus tab strip, also the right
+   panel's strip-plus-toolbar header — so blank header space drags while its
+   controls stay clickable through the base.css no-drag rules. Without the
+   strip the header compacts to the title row, which the 52px band already
+   covers; entry pages keep the 52px strip too. */
+.frame[data-panel-conversation]:has([data-conversation-tabs]) .leadingBand {
+  height: 76px;
+}
+
+/* The seat itself: the two 28px controls centered on the conversation title
+   row (10px header inset + 30px row → centre y 25) and level with the traffic
+   lights (centre y ≈ 24). Sits above column content, below frame overlays
+   (20) and the fullscreen right panel (40). The box subtracts itself from any
+   window drag band beneath (Electron app-regions are geometry, not stacking). */
+.leadingSeat {
+  position: absolute;
+  top: 11px;
+  left: 88px;
+  z-index: 15;
+  display: flex;
+  align-items: center;
+  -webkit-app-region: no-drag;
+}
+
 /* Drag handles are frame children (columns clip overflow): an 8px hit strip
    centered on the column border via inline left, above column content. No
    handle draws a visible pill: the details column was the only one that did,
@@ -108,8 +240,12 @@
   cursor: col-resize;
   z-index: 11;
   touch-action: none;
-  /* Rides the same curve as the tracks so the pill stays on the moving
-     border during collapse/expand; paused while dragging (frame rule). */
+}
+
+/* Rides the same curve as the tracks so the pill stays on the moving border
+   during collapse/expand; instant at steady state (viewport-driven moves)
+   and while dragging. */
+.frame[data-animating] .handle {
   transition: left var(--ds-transition-duration-slow) var(--ds-ease-in-out);
 }
 
@@ -126,7 +262,7 @@
 }
 
 @media (prefers-reduced-motion: reduce) {
-  .handle {
+  .frame[data-animating] .handle {
     transition: none;
   }
 }
diff --git a/packages/client/ui-layout/src/client/AppFrame.tsx b/packages/client/ui-layout/src/client/AppFrame.tsx
index 323318f3e1..e9ed81aa47 100644
--- a/packages/client/ui-layout/src/client/AppFrame.tsx
+++ b/packages/client/ui-layout/src/client/AppFrame.tsx
@@ -19,7 +19,7 @@ import type { ReactNode } from 'react'
 import type {
   PropsLocale, PropsRenderSlots, PropsRuntime, PropsStore,
 } from '@deepseek-ai/dsh-client-ui-slots'
-import { computeColumns, RIGHTBAR_DEFAULT_RATIO, SIDEBAR_AUTO_COLLAPSE, SIDEBAR_COLLAPSED, SIDEBAR_DEFAULT } from './columns.ts'
+import { CENTER_MIN, clampWidth, computeColumns, RIGHTBAR_DEFAULT_RATIO, RIGHTBAR_MAX_RATIO, RIGHTBAR_MIN, SIDEBAR_AUTO_COLLAPSE, SIDEBAR_COLLAPSED, SIDEBAR_DEFAULT } from './columns.ts'
 import { DocumentTitle } from './DocumentTitle.tsx'
 import type { createLayoutStore } from './stores.ts'
 import css from './AppFrame.module.css'
@@ -27,7 +27,7 @@ import css from './AppFrame.module.css'
 /** Full composed props: runtime share + child-slot render share + store share. */
 export type AppFrameProps =
   & PropsRuntime<'root'>
-  & PropsRenderSlots<'sidebar' | 'main' | 'rightbar' | 'shell.overlay'>
+  & PropsRenderSlots<'sidebar' | 'main' | 'rightbar' | 'shell.overlay' | 'shell.leading'>
   & PropsStore<ReturnType<typeof createLayoutStore>>
   & PropsLocale<'common'>
 
@@ -42,6 +42,24 @@ function MainPanel({ usePanelInfo, renderSlot }: Pick<PropsRuntime<'root'>, 'use
   return renderSlot('main', {}, { entryKey: panelId ?? 'conversation' })
 }
 
+/**
+ * Marks the frame while the Conversation is selected — the deepened drag band
+ * (AppFrame.module.css) keys off the attribute. A DOM write from a child keeps
+ * the frame itself out of the panel subscription: selecting a panel must not
+ * re-render the columns.
+ */
+function ConversationMarker({ usePanelInfo, frameRef }: Pick<PropsRuntime<'root'>, 'usePanelInfo'> & { frameRef: React.RefObject<HTMLDivElement | null> }) {
+  const conversationActive = usePanelInfo(info => info.activePanelId === null)
+  useLayoutEffect(() => {
+    const frame = frameRef.current
+    /* v8 ignore next -- the ref is attached by effect time: the marker renders inside the frame div. */
+    if (frame === null) return
+    if (conversationActive) frame.setAttribute('data-panel-conversation', '')
+    else frame.removeAttribute('data-panel-conversation')
+  }, [conversationActive, frameRef])
+  return null
+}
+
 /**
  * Right column grid item. Zero-width unless the occupant asked for a track; the
  * occupant's panel is positioned against the column's right edge, which never
@@ -163,8 +181,10 @@ export function AppFrame({
     ? 0
     : layoutInfo.sidebar === 0 ? SIDEBAR_DEFAULT : layoutInfo.sidebar
   const rightbarPreference = layoutInfo.rightbar ?? viewport * RIGHTBAR_DEFAULT_RATIO
-  // Desktop reopen controls occupy the macOS session header or Windows caption row.
-  const collapsedWidth = document.documentElement.dataset.platform === 'darwin'
+  // Desktop reopen controls occupy the frame's shell.leading seat (macOS) or
+  // the Windows caption row; neither platform keeps an icon rail.
+  const darwin = document.documentElement.dataset.platform === 'darwin'
+  const collapsedWidth = darwin
     || document.documentElement.hasAttribute('data-windows-titlebar') ? 0 : SIDEBAR_COLLAPSED
   // Opening on a narrow frame collapses the left sidebar. Eligibility must
   // include that space before the occupant's first shown report arrives.
@@ -183,6 +203,42 @@ export function AppFrame({
   // Track-level transitions pause for the whole gesture: eased tracks would
   // detach the column edge from the pointer (AppFrame.module.css).
   const [dragging, setDragging] = useState(false)
+  // Track easing is scoped to a discrete open/close toggle: data-animating
+  // goes up when the collapse state or the rightbar track flips and comes down
+  // at transition end (timeout as the reduced-motion/covered-frame fallback).
+  // Steady-state viewport updates stay instant (AppFrame.module.css), and so
+  // does a toggle arriving together with a viewport change — that is the
+  // responsive auto-collapse firing mid window-resize, where easing would
+  // chase the live window edge. The counter restarts the settle window when a
+  // re-toggle interrupts a running transition.
+  const [animating, setAnimating] = useState(0)
+  const trackToggle = `${sidebarCollapsed}:${layoutInfo.rightbarTrack}`
+  const previousToggle = useRef(trackToggle)
+  const previousViewport = useRef(viewport)
+  useLayoutEffect(() => {
+    const viewportChanged = previousViewport.current !== viewport
+    previousViewport.current = viewport
+    if (previousToggle.current === trackToggle) return
+    previousToggle.current = trackToggle
+    if (viewportChanged) return
+    setAnimating(token => token + 1)
+  }, [trackToggle, viewport])
+  useEffect(() => {
+    if (animating === 0) return
+    const frame = frameRef.current
+    /* v8 ignore next -- the ref is always attached by effect time: the frame div renders unconditionally. */
+    if (frame === null) return
+    const settle = () => { setAnimating(0) }
+    const onTransitionEnd = (event: TransitionEvent) => {
+      if (event.target === frame && event.propertyName === 'grid-template-columns') settle()
+    }
+    frame.addEventListener('transitionend', onTransitionEnd)
+    const timer = setTimeout(settle, 600)
+    return () => {
+      frame.removeEventListener('transitionend', onTransitionEnd)
+      clearTimeout(timer)
+    }
+  }, [animating])
   const onDragEnd = useCallback(() => { setDragging(false) }, [])
   const onSidebarStart = useCallback(() => { sidebarBase.current = colsRef.current.sidebar; setDragging(true) }, [])
   const onSidebarDrag = useCallback((dx: number) => {
@@ -193,6 +249,14 @@ export function AppFrame({
     actions.setRightbar(rightbarBase.current - dx)
   }, [actions])
   const productTitle = process.env.DSH_CLIENT_TITLE ?? t('brand.localBuild')
+  // The rendered template lets the grid solve the squeeze natively: the centre
+  // declares its protected minimum and the right column bids up to the clamped
+  // preference, so a window resize lands in the same layout pass as the frame
+  // edge. The JS solve lags the viewport by a ResizeObserver + rAF frame; when
+  // it priced the squeeze itself, the centre column absorbed each width change
+  // whole and was corrected two frames later — visible jitter. cols keeps only
+  // the discrete decisions (track present, collapse state) and the drag base.
+  const rightbarMax = cols.rightbar === 0 ? 0 : clampWidth(rightbarPreference, RIGHTBAR_MIN, viewport * RIGHTBAR_MAX_RATIO)
   const sidebar = useMemo(() => renderSlot('sidebar', {
     collapsed: sidebarCollapsed,
     width: cols.sidebar,
@@ -201,6 +265,13 @@ export function AppFrame({
     <MainPanel usePanelInfo={usePanelInfo} renderSlot={renderSlot} />
   ), [usePanelInfo, renderSlot])
   const overlays = useMemo(() => renderSlot('shell.overlay', {}), [renderSlot])
+  // Window-chrome seat over the main panels' top-left corner: only a fully
+  // hidden sidebar column on macOS desktop leaves window chrome without a
+  // home — the Windows zero-width collapse keeps its controls in the caption
+  // row (ui-sidebar). AppFrame.module.css publishes the matching
+  // --dsh-frame-leading-clearance under the same collapsed condition.
+  const leading = useMemo(() => renderSlot('shell.leading', {}), [renderSlot])
+  const leadingMounted = darwin && sidebarCollapsed
 
   return (
     <div
@@ -210,14 +281,20 @@ export function AppFrame({
         ...(document.documentElement.hasAttribute('data-windows-titlebar')
           ? { '--dsh-windows-sidebar-width': `${cols.sidebar}px` } : {}),
         gridTemplateColumns:
-          `${cols.sidebar}px minmax(0, 1fr) ${cols.rightbar}px`,
+          `${cols.sidebar}px minmax(${cols.rightbar === 0 ? 0 : CENTER_MIN}px, 1fr) minmax(0px, ${rightbarMax}px)`,
       }}
       data-sidebar-collapsed={sidebarCollapsed || undefined}
       data-rightbar-collapsed={cols.rightbar === 0 || undefined}
       data-rightbar-fullscreen={layoutInfo.rightbarFullscreen || undefined}
       data-rightbar-instant={layoutInfo.rightbarInstant || undefined}
       data-dragging={dragging || undefined}
+      data-animating={animating > 0 || undefined}
     >
+      {/* First child: app-regions compose in document order, so everything
+          mounted later (chrome controls, overlays) subtracts its no-drag
+          from this band. */}
+      {darwin && <div className={css.leadingBand} data-shell-leading-band />}
+      <ConversationMarker usePanelInfo={usePanelInfo} frameRef={frameRef} />
       <DocumentTitle
         productTitle={productTitle}
         useSessions={useSessions}
@@ -235,6 +312,11 @@ export function AppFrame({
       <div className={css.overlayLayer} data-shell-overlay>
         {overlays}
       </div>
+      {leadingMounted && (
+        <div className={css.leadingSeat} data-shell-leading>
+          {leading}
+        </div>
+      )}
       {/* The collapsed rail is fixed-width: no resize handle while closed. */}
       {!sidebarCollapsed && <DragHandle side="sidebar" left={cols.sidebar} onStart={onSidebarStart} onDrag={onSidebarDrag} onEnd={onDragEnd} />}
       {layoutInfo.rightbarShown && !layoutInfo.rightbarFullscreen && normal.rightbar > 0 && (
diff --git a/packages/client/ui-layout/src/client/index.ts b/packages/client/ui-layout/src/client/index.ts
index 6fa3acb71e..045fcb8a39 100644
--- a/packages/client/ui-layout/src/client/index.ts
+++ b/packages/client/ui-layout/src/client/index.ts
@@ -1,7 +1,7 @@
 /**
  * Layout plugin, browser half: one register() call contributes AppFrame into
  * the runtime's built-in 'root' slot and, in the same breath, declares the
- * four child slots (declaration = exclusive render authority), seats the
+ * five child slots (declaration = exclusive render authority), seats the
  * layout store (panel geometry), and wires the panel-action service face.
  * ctx.layout selects the main panel and controls column geometry; Session
  * selection belongs to the Session Controller. A second effect seats the theme
@@ -45,7 +45,7 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
 
   interface SlotMap {
     // The 'root' entry itself is the runtime's built-in slot (declared
-    // there); these four are the frame's children, declared by the same
+    // there); these five are the frame's children, declared by the same
     // register() call that contributes AppFrame. Session owners never pass
     // sessionId: the framework injects it as a standard prop.
     /**
@@ -89,6 +89,20 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
      * `id` is added beside the shipped entries instead of replacing them.
      */
     'shell.overlay': { kind: 'list'; scope: 'root' }
+    /**
+     * Window-chrome seat at the frame's top-left, over every main panel.
+     * Mounted only while the sidebar column is fully hidden (macOS desktop
+     * collapse; other platforms keep the rail), so the occupant can assume the
+     * frame edge is the window edge and the macOS traffic lights sit before it.
+     * OCCUPIED by ui-sidebar's reopen/New Session controls.
+     *
+     * While the seat is mounted the frame publishes
+     * `--dsh-frame-leading-clearance` (the inline inset the seat's band
+     * occupies, measured from the frame's left edge); a main panel whose
+     * content reaches the top-left corner pads by it so nothing lands under
+     * the lights or the controls.
+     */
+    'shell.leading': { kind: 'single'; scope: 'root' }
   }
 }
 
@@ -123,7 +137,7 @@ export const inject = ['slots', 'theme', 'locale']
 
 /**
  * Client plugin body: provide ctx.layout, then one register() call — AppFrame
- * into 'root' with the four child-slot declarations, the layout store seat,
+ * into 'root' with the five child-slot declarations, the layout store seat,
  * and the shared root instance supplying commands and the panel-info source.
  * @param ctx - client root context.
  */
@@ -152,6 +166,7 @@ export function apply(ctx: ClientContext): void {
         'main': { kind: 'keyed', scope: 'root' },
         'rightbar': { kind: 'single', scope: 'root' },
         'shell.overlay': { kind: 'list', scope: 'root' },
+        'shell.leading': { kind: 'single', scope: 'root' },
       },
       store,
     }, AppFrame)
diff --git a/packages/client/ui-layout/tests/app-frame.client.spec.tsx b/packages/client/ui-layout/tests/app-frame.client.spec.tsx
index 7409588916..b097c4b62c 100644
--- a/packages/client/ui-layout/tests/app-frame.client.spec.tsx
+++ b/packages/client/ui-layout/tests/app-frame.client.spec.tsx
@@ -113,10 +113,15 @@ function mountFrame(windowWidth = frameWidth) {
   }
 }
 
+/* The template delegates the squeeze to the grid (jsdom does no layout, so
+   specs read the specified tracks): [sidebar px, rightbar growth limit].
+   The centre's protected minimum must accompany an open right track. */
 function tracks(frame: HTMLElement): number[] {
-  const match = /^([\d.]+)px minmax\(0, 1fr\) ([\d.]+)px$/.exec(frame.style.gridTemplateColumns)
+  const match = /^([\d.]+)px minmax\((0|400)px, 1fr\) minmax\(0px, ([\d.]+)px\)$/.exec(frame.style.gridTemplateColumns)
   if (match === null) throw new Error(`unexpected template: ${frame.style.gridTemplateColumns}`)
-  return [Number(match[1]), Number(match[2])]
+  const rightbar = Number(match[3])
+  if ((match[2] === '400') !== (rightbar > 0)) throw new Error(`centre minimum out of step: ${frame.style.gridTemplateColumns}`)
+  return [Number(match[1]), rightbar]
 }
 
 function handleFor(frame: HTMLElement, side: 'sidebar' | 'rightbar'): HTMLElement {
@@ -169,6 +174,7 @@ afterEach(() => {
   try {
     cleanup()
   } finally {
+    delete document.documentElement.dataset.platform
     for (const restore of restoreProperties.splice(0).reverse()) restore()
     document.title = originalTitle
     vi.restoreAllMocks()
@@ -223,23 +229,45 @@ describe('AppFrame', () => {
   it('keeps Windows caption controls mounted with a zero-width collapsed column', () => {
     document.documentElement.setAttribute('data-windows-titlebar', '')
     try {
-      const { frame, instance, sidebarOwner, getByTestId } = mountFrame()
+      const { frame, instance, sidebarOwner, getByTestId, queryByTestId } = mountFrame()
       act(() => { instance.actions.toggleSidebar() })
       expect(tracks(frame)[0]).toBe(0)
       expect(sidebarOwner()).toMatchObject({ collapsed: true, width: 0 })
       expect(getByTestId('sidebar-content')).toBeTruthy()
+      // The caption row keeps the reopen controls; the darwin-only
+      // shell.leading seat must not mount a duplicate set.
+      expect(queryByTestId('shell.leading-content')).toBeNull()
     } finally {
       document.documentElement.removeAttribute('data-windows-titlebar')
     }
   })
 
   it('keeps the closed sidebar mounted at its 56px rail without a handle', () => {
-    const { frame, instance, sidebarOwner, getByTestId } = mountFrame()
+    const { frame, instance, sidebarOwner, getByTestId, queryByTestId } = mountFrame()
     act(() => { instance.actions.toggleSidebar() })
     expect(tracks(frame)).toEqual([56, 0])
     expect(sidebarOwner()).toEqual({ collapsed: true, width: 56 })
     expect(getByTestId('sidebar-content')).toBeTruthy()
     expect(frame.querySelector('[data-side="sidebar"]')).toBeNull()
+    // The rail keeps the window chrome housed: no shell.leading seat.
+    expect(queryByTestId('shell.leading-content')).toBeNull()
+    expect(frame.querySelector('[data-shell-leading-band]')).toBeNull()
+  })
+
+  it('mounts the shell.leading seat only while the darwin collapse hides the column', () => {
+    document.documentElement.dataset.platform = 'darwin'
+    const { frame, instance, sidebarOwner, queryByTestId } = mountFrame()
+    // The window drag band composes app-regions in DOM order: it must render
+    // before all column content so every later no-drag subtracts from it.
+    expect(frame.firstElementChild?.hasAttribute('data-shell-leading-band')).toBe(true)
+    expect(queryByTestId('shell.leading-content')).toBeNull()
+    act(() => { instance.actions.toggleSidebar() })
+    expect(tracks(frame)).toEqual([0, 0])
+    expect(sidebarOwner()).toEqual({ collapsed: true, width: 0 })
+    expect(frame.querySelector('[data-shell-leading]')).not.toBeNull()
+    expect(queryByTestId('shell.leading-content')).toBeTruthy()
+    act(() => { instance.actions.toggleSidebar() })
+    expect(queryByTestId('shell.leading-content')).toBeNull()
   })
 
   it('switches only the keyed main outlet when the active panel changes', () => {
@@ -253,6 +281,8 @@ describe('AppFrame', () => {
       expect(slotCalls).toEqual([{ key: 'main', props: {}, options: { entryKey: panelId ?? 'conversation' } }])
       expect(getByTestId('main-content').getAttribute('data-entry-key')).toBe(panelId ?? 'conversation')
       expect(instance.getSnapshot().panelInfo).toEqual({ activePanelId: panelId })
+      // The deepened conversation drag band keys off this frame marker.
+      expect(frame.hasAttribute('data-panel-conversation')).toBe(panelId === null)
       expect(instance.getSnapshot().layoutInfo).toBe(layoutInfo)
       expect(tracks(frame)).toEqual([280, 0])
       expect(selectedSession).toBe(sessionId)
@@ -277,10 +307,12 @@ describe('AppFrame normal width concessions', () => {
     const { frame, instance, rightOwner } = mountFrame()
     act(() => { instance.actions.setSidebar(420); instance.actions.openRightbar(true, false) })
     resize(1200)
-    expect(tracks(frame)).toEqual([420, 380])
+    // The template carries the ratio-clamped preference; the panel (rightOwner
+    // width) reports the resolved squeeze.
+    expect(tracks(frame)).toEqual([420, 840])
     expect(rightOwner()).toEqual({ width: 380, viewportWidth: 1200, canShow: true })
     resize(1120)
-    expect(tracks(frame)).toEqual([420, 300])
+    expect(tracks(frame)).toEqual([420, 784])
     resize(1119)
     expect(tracks(frame)).toEqual([420, 0])
     expect(rightOwner()).toEqual({ width: 0, viewportWidth: 1119, canShow: false })
@@ -300,7 +332,7 @@ describe('AppFrame normal width concessions', () => {
     expect(tracks(frame)).toEqual([280, 0])
     expect(rightOwner()).toEqual({ width: 344, viewportWidth: 800, canShow: true })
     act(() => { instance.actions.openRightbar(true, false) })
-    expect(tracks(frame)).toEqual([56, 344])
+    expect(tracks(frame)).toEqual([56, 360])
     expect(instance.getSnapshot().layoutInfo).toMatchObject({ narrowExpanded: false, rightbar: 360 })
     expect(rightOwner().canShow).toBe(true)
   })
@@ -387,6 +419,52 @@ describe('AppFrame right panel presentation', () => {
     expect(frame.dataset.rightbarFullscreen).toBeUndefined()
   })
 
+  it('eases tracks only across a discrete toggle, never for viewport updates', () => {
+    const { frame, instance } = mountFrame()
+    expect(frame.dataset.animating).toBeUndefined()
+    // Window-driven track updates follow the frame edge instantly.
+    resize(1600)
+    expect(frame.dataset.animating).toBeUndefined()
+    act(() => { instance.actions.toggleSidebar() })
+    expect(frame.dataset.animating).toBe('true')
+    // Foreign transition ends (e.g. the handle's left) do not settle it...
+    act(() => {
+      frame.dispatchEvent(Object.assign(new Event('transitionend'), { propertyName: 'left' }))
+    })
+    expect(frame.dataset.animating).toBe('true')
+    // ...the track transition's own end does.
+    act(() => {
+      frame.dispatchEvent(Object.assign(new Event('transitionend'), { propertyName: 'grid-template-columns' }))
+    })
+    expect(frame.dataset.animating).toBeUndefined()
+  })
+
+  it('lands the responsive auto-collapse instantly, keeping user toggles eased', () => {
+    const { frame, instance } = mountFrame()
+    // Shrinking across the breakpoint flips the collapse in the same update as
+    // the viewport change: no easing, the tracks land with the window edge.
+    resize(900)
+    expect(frame.dataset.sidebarCollapsed).toBe('true')
+    expect(frame.dataset.animating).toBeUndefined()
+    // A user toggle at the now-stable viewport still eases.
+    act(() => { instance.actions.toggleSidebar() })
+    expect(frame.dataset.animating).toBe('true')
+  })
+
+  it('animates the rightbar track flip and settles by timeout without a transition end', () => {
+    vi.useFakeTimers()
+    try {
+      const { frame, instance } = mountFrame()
+      act(() => { instance.actions.openRightbar(true, false) })
+      expect(frame.dataset.animating).toBe('true')
+      // Covered or reduced-motion frames fire no transitionend; the timeout settles.
+      act(() => { vi.advanceTimersByTime(600) })
+      expect(frame.dataset.animating).toBeUndefined()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('keeps fullscreen suppression independent from resetting the instant marker', () => {
     const { frame, instance } = mountFrame()
     act(() => { instance.actions.openRightbar(true, true) })
@@ -477,7 +555,7 @@ describe('AppFrame pointer resizing', () => {
     resize(1100)
     const handle = handleFor(frame, 'rightbar')
     expect(rightOwner().width).toBe(420)
-    expect(tracks(frame)[1]).toBe(420)
+    expect(tracks(frame)[1]).toBe(770)
     expect(handle.style.left).toBe('680px')
     drag(handle, 680, 690)
     expect(instance.getSnapshot().layoutInfo.rightbar).toBe(410)
diff --git a/packages/client/ui-layout/tests/apply.client.spec.ts b/packages/client/ui-layout/tests/apply.client.spec.ts
index b0e0c1614e..1b78c74c70 100644
--- a/packages/client/ui-layout/tests/apply.client.spec.ts
+++ b/packages/client/ui-layout/tests/apply.client.spec.ts
@@ -80,7 +80,7 @@ describe('ui-layout client apply', () => {
     expect(inject).toEqual(['slots', 'theme', 'locale'])
   })
 
-  it('provides ctx.layout and declares the four root-scoped frame slots', async () => {
+  it('provides ctx.layout and declares the five root-scoped frame slots', async () => {
     const { ctx, slots } = await bench()
     const fiber = ctx.plugin({ inject: [...inject], apply })
     await fiber.await()
@@ -90,6 +90,7 @@ describe('ui-layout client apply', () => {
     expect(slots.spec('main')).toEqual({ kind: 'keyed', scope: 'root' })
     expect(slots.spec('rightbar')).toEqual({ kind: 'single', scope: 'root' })
     expect(slots.spec('shell.overlay')).toEqual({ kind: 'list', scope: 'root' })
+    expect(slots.spec('shell.leading')).toEqual({ kind: 'single', scope: 'root' })
   })
 
   it('shares a pre-created instance between service actions, root rendering, and panelInfo', async () => {
@@ -160,6 +161,7 @@ describe('ui-layout client apply', () => {
     expect(slots.spec('main')).toBeUndefined()
     expect(slots.spec('rightbar')).toBeUndefined()
     expect(slots.spec('shell.overlay')).toBeUndefined()
+    expect(slots.spec('shell.leading')).toBeUndefined()
     expect(host.root.getSnapshot().hooks.panelInfo).toBeUndefined()
     // The built-in root declaration survives entry teardown (renderer-owned).
     expect(slots.spec('root')).toEqual({ kind: 'single', scope: 'root' })
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
index 6117894489..96286b3b16 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
@@ -22,6 +22,13 @@
   align-items: flex-start;
   justify-content: space-between;
   gap: 16px;
+  box-sizing: border-box;
+}
+
+/* macOS hiddenInset titlebar: the frame's top clearance keeps the head below
+   the window's top strip in both sidebar states so it never jumps. */
+:global([data-platform='darwin']) .pageHead {
+  padding-top: var(--dsh-frame-top-clearance, 0px);
 }
 
 .pageTitle {
@@ -395,10 +402,11 @@
 }
 
 /* Wider than the default dialog: pnpm's lines are long, and the terminal keeps them unwrapped. The card never
-   outgrows the viewport; the running screens scroll inside it so the head's controls stay reachable. */
+   outgrows the Modal's padding box and shares the settings panel's 800px height cap; the running screens
+   scroll inside it so the head's controls stay reachable. */
 .installDialog {
   width: min(560px, 100%);
-  max-height: calc(100vh - 48px);
+  max-height: min(800px, 100%);
 }
 
 /* The spec screen's content scrolls inside the card when the guide is open on a short viewport; the footer stays put. */
@@ -1035,6 +1043,12 @@ label.registryOption {
   flex-direction: column;
 }
 
+/* Same top clearance as .pageHead: the crumb is the detail views' leading
+   content and otherwise lands under the traffic lights. */
+:global([data-platform='darwin']) .detail {
+  padding-top: var(--dsh-frame-top-clearance, 0px);
+}
+
 .crumb {
   display: inline-flex;
   align-items: center;
diff --git a/packages/client/ui-primitives/README.i18n.yaml b/packages/client/ui-primitives/README.i18n.yaml
index 82bd1b374e..8d8279ffea 100644
--- a/packages/client/ui-primitives/README.i18n.yaml
+++ b/packages/client/ui-primitives/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-primitives/README.md
-README.md: f1267219e6bc50bccdd2dd65771ac8577ddc2e26
-README.zh.md: 15c327c3bd756d8d0684c15c858d4443008d03cc
+README.md: 4bc5d53f1fde5ac65015ef023134b163b351797f
+README.zh.md: 481a84150f480c87568a91af0311a3d4fcf2c637
diff --git a/packages/client/ui-primitives/README.md b/packages/client/ui-primitives/README.md
index f1267219e6..4bc5d53f1f 100644
--- a/packages/client/ui-primitives/README.md
+++ b/packages/client/ui-primitives/README.md
@@ -71,7 +71,7 @@ Writing your own component in your own package is fine when the need is genuinel
 
 ### Controls and icons
 
-The catalog above lists what each export is for; this section covers the behavior that props alone do not show. Product icon names omit artboard sizes and end in `Regular` for the supplied one-pixel artwork or `Medium` for the same geometry at a 1.3px stroke; the `size` prop controls rendered dimensions ([decision](../../../.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.md)). Each product, reference, link, and permission glyph intentionally keeps both weight exports even when the current product uses only one, so callers can choose emphasis without adding another API later; fill-only pairs render identically. `IconWarningOutlineRegular`/`Medium` use a circle; `IconWarningTriangleOutlineRegular`/`Medium` use a rounded triangle. `FishLogo` and `BrandWordmark` fill brand slots. `FileTypeIcon` renders the traditional 28px spreadsheet, folder, HTML, image, Markdown, generic, PDF, PPT, video, and Word glyphs, and uses the imported square technology artwork for the established 48 code and configuration categories. The import replaces artwork only: archive-only categories do not extend `CodeFileType`. `classifyFileType` applies exact filename, prefix, suffix, optional project-context, and extension rules in that order; React names win over TypeScript/JavaScript, Angular suffixes win over their base extension, and a Dart file becomes Flutter only when the supplied project files contain a `pubspec.yaml` with `flutter:`. Markdown and SVG remain traditional Markdown and image files. Spreadsheet mappings include CSV, TSV, Excel workbooks and templates, OpenDocument spreadsheets, and Numbers; KEY maps to slides, while RTF/ODT/Pages map to documents. `fileExtension` exposes the same basename and final-dot parsing for adjacent metadata labels. Traditional glyphs use a solid category-colored sheet with a white mark and translucent white corner; the generic file uses a grey sheet and darker grey corner. Callers may override the sheet color through `--dsh-file-type-icon-color`. The full-color technology artwork is the deliberate exception and retains its embedded palette. All glyphs are decorative and carry no label. `LinkIconMedium` is the leading glyph for clickable artifact links — globe, folder, code, image, document, or plain paper, and for a `url` link the mark of a well-known site named by its `href` — the developer sites a transcript usually cites (GitHub, GitLab, npm, PyPI, Stack Overflow, MDN, Wikipedia, Hacker News, YouTube, X, Bilibili, Zhihu, Juejin, CSDN) and mainstream search, video, social, shopping, and reference sites (Google, Baidu, DuckDuckGo, TikTok, Netflix, Spotify, Facebook, Instagram, Reddit, Telegram, WhatsApp, WeChat, QQ, Weibo, Taobao, AliExpress, eBay, Quora, V2EX, Apple) — while `classifyLinkPath` folds the shared file types into that existing six-category vocabulary. `ConnectionIndicator` renders a warning-colored disconnected action whose permanent retry glyph marks the retry action beside the owner-supplied outage label, the shared ongoing loader beside a label whose one-to-three dots advance every 500ms independently of retry timing, or a success-colored recovered status. Clicking either warning state requests an immediate reconnect; no hover interaction changes the copy. The pill fades in on appearance, fades out for 150ms before unmounting, and sizes to its current label. Its owner supplies visibility, the recovery hold, localized labels, and the immediate-reconnect callback; the primitive uses no native title tooltip. `useAnchoredPosition` and `useAnchoredMaxHeight` keep floating panels and bottom-anchored overlays clamped to the viewport and following their anchor. `HoverCard` keeps its portaled preview reachable across the anchor gap and can expose a copy button through the `copyText` prop. `Toast` uses the owner's `holdMs` for both the fade delay and its hold-and-fade lifetime. Rerenders with unchanged `holdMs` do not restart that lifetime; completion uses the latest callback, and fully faded actions cannot receive input. A new component key restarts the banner. `rankByName` is the `/` menu's shared candidate ranker for the command and skill sources: the query must be a case-insensitive ordered subsequence of the name; prefix hits rank first, then alignment score, then source order. `Menu.autoFocus` focuses its first enabled item, supports Arrow Up/Down and Home/End navigation, and focuses the first button in the anchor on Escape; it is opt-in for action menus.
+The catalog above lists what each export is for; this section covers the behavior that props alone do not show. Product icon names omit artboard sizes and end in `Regular` for the supplied one-pixel artwork or `Medium` for the same geometry at a 1.3px stroke; the `size` prop controls rendered dimensions ([decision](../../../.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.md)). Each product, reference, link, and permission glyph intentionally keeps both weight exports even when the current product uses only one, so callers can choose emphasis without adding another API later; fill-only pairs render identically. `IconWarningOutlineRegular`/`Medium` use a circle; `IconWarningTriangleOutlineRegular`/`Medium` use a rounded triangle. `FishLogo` and `BrandWordmark` fill brand slots. `FileTypeIcon` renders the traditional 28px spreadsheet, folder, HTML, image, Markdown, generic, PDF, PPT, video, and Word glyphs, and uses the imported square technology artwork for the established 48 code and configuration categories. The import replaces artwork only: archive-only categories do not extend `CodeFileType`. `classifyFileType` applies exact filename, prefix, suffix, optional project-context, and extension rules in that order; React names win over TypeScript/JavaScript, Angular suffixes win over their base extension, and a Dart file becomes Flutter only when the supplied project files contain a `pubspec.yaml` with `flutter:`. Markdown and SVG remain traditional Markdown and image files. Spreadsheet mappings include CSV, TSV, Excel workbooks and templates, OpenDocument spreadsheets, and Numbers; KEY maps to slides, while RTF/ODT/Pages map to documents. `fileExtension` exposes the same basename and final-dot parsing for adjacent metadata labels. Traditional glyphs use a solid category-colored sheet with a white mark and translucent white corner; the generic file uses a grey sheet and darker grey corner. Callers may override the sheet color through `--dsh-file-type-icon-color`. The full-color technology artwork is the deliberate exception and retains its embedded palette. All glyphs are decorative and carry no label. `LinkIconMedium` is the leading glyph for clickable artifact links — globe, folder, code, image, document, or plain paper, and for a `url` link the mark of a well-known site named by its `href` — the developer sites a transcript usually cites (GitHub, GitLab, npm, PyPI, Stack Overflow, MDN, Wikipedia, Hacker News, YouTube, X, Bilibili, Zhihu, Juejin, CSDN) and mainstream search, video, social, shopping, and reference sites (Google, Baidu, DuckDuckGo, TikTok, Netflix, Spotify, Facebook, Instagram, Reddit, Telegram, WhatsApp, WeChat, QQ, Weibo, Taobao, AliExpress, eBay, Quora, V2EX, Apple) — while `classifyLinkPath` folds the shared file types into that existing six-category vocabulary. `ConnectionIndicator` renders a warning-colored disconnected action whose permanent retry glyph marks the retry action beside the owner-supplied outage label, the shared ongoing loader beside a label whose one-to-three dots advance every 500ms independently of retry timing, or a success-colored recovered status. Clicking either warning state requests an immediate reconnect; no hover interaction changes the copy. The pill fades in on appearance, fades out for 150ms before unmounting, and sizes to its current label. Its owner supplies visibility, the recovery hold, localized labels, and the immediate-reconnect callback; the primitive uses no native title tooltip. `useAnchoredPosition` and `useAnchoredMaxHeight` keep floating panels and bottom-anchored overlays clamped to the viewport and following their anchor; `useAnchoredMaxHeight` and portalled `Menu` widen their 12px top viewport margin to the frame's published `--dsh-frame-top-clearance`. `HoverCard` keeps its portaled preview reachable across the anchor gap and can expose a copy button through the `copyText` prop. `Toast` uses the owner's `holdMs` for both the fade delay and its hold-and-fade lifetime. Rerenders with unchanged `holdMs` do not restart that lifetime; completion uses the latest callback, and fully faded actions cannot receive input. A new component key restarts the banner. `rankByName` is the `/` menu's shared candidate ranker for the command and skill sources: the query must be a case-insensitive ordered subsequence of the name; prefix hits rank first, then alignment score, then source order. `Menu.autoFocus` focuses its first enabled item, supports Arrow Up/Down and Home/End navigation, and focuses the first button in the anchor on Escape; it is opt-in for action menus.
 
 ### Rendering agent output
 
diff --git a/packages/client/ui-primitives/README.zh.md b/packages/client/ui-primitives/README.zh.md
index 15c327c3bd..481a84150f 100644
--- a/packages/client/ui-primitives/README.zh.md
+++ b/packages/client/ui-primitives/README.zh.md
@@ -71,7 +71,7 @@ kind: "package-library"
 
 ### 控件与图标
 
-上面的目录说明每个导出的用途；本节讲 props 本身看不出来的行为。产品图标名称不含画板尺寸，以 `Regular` 表示原始 1px 图形，以 `Medium` 表示同一几何的 1.3px 描边；`size` prop 控制渲染尺寸（[决定](../../../.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.zh.md)）。每个产品、引用、链接与权限图形都会有意保留两种线重导出，即使当前产品只使用其中一种，也让调用方无需再次扩展 API 就能选择强调程度；仅填充的成对图形外观相同。`IconWarningOutlineRegular`/`Medium` 使用圆形；`IconWarningTriangleOutlineRegular`/`Medium` 使用圆角三角形。`FishLogo` 与 `BrandWordmark` 填充品牌 slot。`FileTypeIcon` 渲染传统的 28px spreadsheet、folder、HTML、image、Markdown、generic、PDF、PPT、video 与 Word 图形，并为现有 48 个代码和配置类别使用导入的方形技术图形。该导入只替换图形：资源包中额外的类别不会扩展 `CodeFileType`。`classifyFileType` 按完整文件名、前缀、后缀、可选项目上下文、扩展名的顺序匹配；React 文件名优先于 TypeScript/JavaScript，Angular 后缀优先于基础扩展名，只有传入的项目文件包含带 `flutter:` 的 `pubspec.yaml` 时 Dart 文件才使用 Flutter。Markdown 与 SVG 仍分别使用传统 Markdown 与图片图形。表格映射包括 CSV、TSV、Excel 工作簿与模板、OpenDocument 表格和 Numbers；KEY 映射为幻灯片，RTF/ODT/Pages 映射为文档。`fileExtension` 为相邻元数据 label 暴露同一套 basename 与最终点号解析。传统图形使用实色分类底板、白色标记和半透明白色折角；通用文件使用灰色底板与较深灰色折角。调用方可通过 `--dsh-file-type-icon-color` 覆盖底板颜色。全彩技术图形是明确例外，会保留其内嵌调色板。所有图形都是装饰性的，不自带 label。`LinkIconMedium` 是可点击产物链接的前置图形——地球、文件夹、代码、图片、文档或纸张，`url` 链接的 `href` 指向已知站点时则改用该站点自己的标记——转写内容常引用的开发者站点（GitHub、GitLab、npm、PyPI、Stack Overflow、MDN、Wikipedia、Hacker News、YouTube、X、Bilibili、知乎、掘金、CSDN），以及主流搜索、视频、社交、购物与参考资料站点（Google、百度、DuckDuckGo、TikTok、Netflix、Spotify、Facebook、Instagram、Reddit、Telegram、WhatsApp、微信、QQ、微博、淘宝、速卖通、eBay、Quora、V2EX、Apple）——`classifyLinkPath` 把共享文件类型折叠进原有六类词汇。`ConnectionIndicator` 可渲染警告色的断联操作（常驻重试图形指明重试动作，断联文案由持有方提供）、共享 ongoing loading 加一至三个点以独立于 retry 时序的 500ms 节奏推进的连接中状态，或成功色的恢复状态。点击任一警告状态都会请求立即重连；没有任何悬停交互会改变文案。药丸出现时淡入、卸载前淡出 150ms，宽度随当前 label 自适应。它的持有方提供可见性、恢复驻留时间、本地化 label 与立即重连回调；该原语不使用原生 title tooltip。`useAnchoredPosition` 与 `useAnchoredMaxHeight` 让浮动面板与底部锚定浮层始终钳制在视口内并跟随锚点。`HoverCard` 通过指针离开宽限期让采用 portal 的预览在跨过锚点间隙时仍可触及，并可通过 `copyText` prop 提供复制按钮。`Toast` 使用调用方的 `holdMs` 同时控制淡出延迟与停留加淡出的总时长。`holdMs` 未变时，父组件重渲染不会重启该生命周期；完成时调用最新回调，完全淡出的操作不能接收输入。新的组件 key 会重新开始横幅周期。`rankByName` 是 `/` 菜单命令源与 skill（技能）源共享的候选排序器：查询必须是名字的不区分大小写的有序子序列；前缀命中排最前，其次按对齐分数，再按来源顺序。 `Menu.autoFocus` 聚焦首个启用项，支持上下方向键与 Home/End 导航，并在 Escape 时聚焦 anchor 内的第一个按钮；操作菜单可显式启用。
+上面的目录说明每个导出的用途；本节讲 props 本身看不出来的行为。产品图标名称不含画板尺寸，以 `Regular` 表示原始 1px 图形，以 `Medium` 表示同一几何的 1.3px 描边；`size` prop 控制渲染尺寸（[决定](../../../.agents/notes/implemented/architecture/2026-09-16-size-neutral-product-icon-weights.zh.md)）。每个产品、引用、链接与权限图形都会有意保留两种线重导出，即使当前产品只使用其中一种，也让调用方无需再次扩展 API 就能选择强调程度；仅填充的成对图形外观相同。`IconWarningOutlineRegular`/`Medium` 使用圆形；`IconWarningTriangleOutlineRegular`/`Medium` 使用圆角三角形。`FishLogo` 与 `BrandWordmark` 填充品牌 slot。`FileTypeIcon` 渲染传统的 28px spreadsheet、folder、HTML、image、Markdown、generic、PDF、PPT、video 与 Word 图形，并为现有 48 个代码和配置类别使用导入的方形技术图形。该导入只替换图形：资源包中额外的类别不会扩展 `CodeFileType`。`classifyFileType` 按完整文件名、前缀、后缀、可选项目上下文、扩展名的顺序匹配；React 文件名优先于 TypeScript/JavaScript，Angular 后缀优先于基础扩展名，只有传入的项目文件包含带 `flutter:` 的 `pubspec.yaml` 时 Dart 文件才使用 Flutter。Markdown 与 SVG 仍分别使用传统 Markdown 与图片图形。表格映射包括 CSV、TSV、Excel 工作簿与模板、OpenDocument 表格和 Numbers；KEY 映射为幻灯片，RTF/ODT/Pages 映射为文档。`fileExtension` 为相邻元数据 label 暴露同一套 basename 与最终点号解析。传统图形使用实色分类底板、白色标记和半透明白色折角；通用文件使用灰色底板与较深灰色折角。调用方可通过 `--dsh-file-type-icon-color` 覆盖底板颜色。全彩技术图形是明确例外，会保留其内嵌调色板。所有图形都是装饰性的，不自带 label。`LinkIconMedium` 是可点击产物链接的前置图形——地球、文件夹、代码、图片、文档或纸张，`url` 链接的 `href` 指向已知站点时则改用该站点自己的标记——转写内容常引用的开发者站点（GitHub、GitLab、npm、PyPI、Stack Overflow、MDN、Wikipedia、Hacker News、YouTube、X、Bilibili、知乎、掘金、CSDN），以及主流搜索、视频、社交、购物与参考资料站点（Google、百度、DuckDuckGo、TikTok、Netflix、Spotify、Facebook、Instagram、Reddit、Telegram、WhatsApp、微信、QQ、微博、淘宝、速卖通、eBay、Quora、V2EX、Apple）——`classifyLinkPath` 把共享文件类型折叠进原有六类词汇。`ConnectionIndicator` 可渲染警告色的断联操作（常驻重试图形指明重试动作，断联文案由持有方提供）、共享 ongoing loading 加一至三个点以独立于 retry 时序的 500ms 节奏推进的连接中状态，或成功色的恢复状态。点击任一警告状态都会请求立即重连；没有任何悬停交互会改变文案。药丸出现时淡入、卸载前淡出 150ms，宽度随当前 label 自适应。它的持有方提供可见性、恢复驻留时间、本地化 label 与立即重连回调；该原语不使用原生 title tooltip。`useAnchoredPosition` 与 `useAnchoredMaxHeight` 让浮动面板与底部锚定浮层始终钳制在视口内并跟随锚点；`useAnchoredMaxHeight` 与 portal 模式的 `Menu` 会把 12px 的视口顶部边距加宽到框架发布的 `--dsh-frame-top-clearance`。`HoverCard` 通过指针离开宽限期让采用 portal 的预览在跨过锚点间隙时仍可触及，并可通过 `copyText` prop 提供复制按钮。`Toast` 使用调用方的 `holdMs` 同时控制淡出延迟与停留加淡出的总时长。`holdMs` 未变时，父组件重渲染不会重启该生命周期；完成时调用最新回调，完全淡出的操作不能接收输入。新的组件 key 会重新开始横幅周期。`rankByName` 是 `/` 菜单命令源与 skill（技能）源共享的候选排序器：查询必须是名字的不区分大小写的有序子序列；前缀命中排最前，其次按对齐分数，再按来源顺序。 `Menu.autoFocus` 聚焦首个启用项，支持上下方向键与 Home/End 导航，并在 Escape 时聚焦 anchor 内的第一个按钮；操作菜单可显式启用。
 
 ### 渲染 agent 输出
 
diff --git a/packages/client/ui-primitives/src/Menu.module.css b/packages/client/ui-primitives/src/Menu.module.css
index 18600736eb..fe769b2d05 100644
--- a/packages/client/ui-primitives/src/Menu.module.css
+++ b/packages/client/ui-primitives/src/Menu.module.css
@@ -60,12 +60,13 @@
 }
 
 /* Viewport fit: the card stops 12px short of the viewport's top/bottom edges
- * (24 = 2 × the portal MARGIN in Menu.tsx) and taller content scrolls inside
+ * (the portal MARGIN in Menu.tsx; the top side widens to the frame's published
+ * top clearance, the macOS window strip) and taller content scrolls inside
  * .viewport, so a pinned .footer stays visible. Menus with submenu rows skip
  * this class — the overflow clip would crop the side card, so they rely on
  * staying short. */
 .scrollable {
-  max-height: calc(100vh - 24px);
+  max-height: calc(100vh - 12px - max(12px, var(--dsh-frame-top-clearance, 12px)));
 }
 
 .viewport {
diff --git a/packages/client/ui-primitives/src/Menu.tsx b/packages/client/ui-primitives/src/Menu.tsx
index 1a759c7b20..b165c2da54 100644
--- a/packages/client/ui-primitives/src/Menu.tsx
+++ b/packages/client/ui-primitives/src/Menu.tsx
@@ -3,6 +3,7 @@ import type { CSSProperties, ReactNode } from 'react'
 import { createPortal } from 'react-dom'
 import clsx from 'clsx'
 import { IconCheckOutlineRegular } from './icons/index.tsx'
+import { overlayTopMargin } from './overlay-top-margin.ts'
 import { usePointerGrace } from './pointer-grace.ts'
 import css from './Menu.module.css'
 
@@ -197,7 +198,7 @@ export function Menu({ open, anchor, items, selectedId, selectedIds, onSelect, o
       }
 
       if (lw > 0) x = Math.min(Math.max(x, MARGIN), vw - lw - MARGIN)
-      if (lh > 0) y = Math.min(Math.max(y, MARGIN), vh - lh - MARGIN)
+      if (lh > 0) y = Math.min(Math.max(y, overlayTopMargin(MARGIN)), vh - lh - MARGIN)
 
       setFixedPos({ left: x, top: y })
     }
diff --git a/packages/client/ui-primitives/src/Modal.module.css b/packages/client/ui-primitives/src/Modal.module.css
index 44ec4b7d93..8611494214 100644
--- a/packages/client/ui-primitives/src/Modal.module.css
+++ b/packages/client/ui-primitives/src/Modal.module.css
@@ -1,4 +1,8 @@
-/* Full-viewport layer (figma Mask + Dialog 451:18655): mask + centered card. */
+/* Full-viewport layer (figma Mask + Dialog 451:18655): mask + centered card.
+   24px of air on every side; the top/bottom widen to the frame's published
+   top clearance (the macOS window strip) so a tall card stays clear of it.
+   Cards size against this padding box: consumers cap growth with
+   `max-height: 100%`, never their own viewport calc. */
 .root {
   position: fixed;
   inset: 0;
@@ -6,7 +10,7 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  padding: 24px;
+  padding: max(24px, var(--dsh-frame-top-clearance, 24px)) 24px;
 }
 
 /* User/spec mask: rgba(0,0,0,0.24) + blur(2px) via --dsw-alias-bg-mask-1 /
diff --git a/packages/client/ui-primitives/src/RiskConfirmation.module.css b/packages/client/ui-primitives/src/RiskConfirmation.module.css
index 016eeee1d0..ae45ba9e00 100644
--- a/packages/client/ui-primitives/src/RiskConfirmation.module.css
+++ b/packages/client/ui-primitives/src/RiskConfirmation.module.css
@@ -1,6 +1,6 @@
 .confirmation {
   width: min(440px, 100%);
-  max-height: calc(100vh - 48px);
+  max-height: 100%;
   overflow: hidden;
 }
 
diff --git a/packages/client/ui-primitives/src/overlay-top-margin.ts b/packages/client/ui-primitives/src/overlay-top-margin.ts
new file mode 100644
index 0000000000..c522f2d0a4
--- /dev/null
+++ b/packages/client/ui-primitives/src/overlay-top-margin.ts
@@ -0,0 +1,19 @@
+/**
+ * Overlay clearance from the window's top strip. On macOS desktop the frame
+ * publishes `--dsh-frame-top-clearance` on the root element — the constant
+ * step below the traffic-light strip, where clicks drag the window instead of
+ * the overlay. JS-clamped overlays keep at least that much air above them.
+ * Elsewhere the property is absent and the caller's own margin applies.
+ */
+
+/**
+ * Resolve the top margin an overlay keeps from the viewport edge.
+ * @param min - the overlay's own viewport margin in px, used as the floor.
+ * @returns the larger of `min` and the frame's published top clearance.
+ */
+export function overlayTopMargin(min: number): number {
+  const clearance = Number.parseFloat(
+    getComputedStyle(document.documentElement).getPropertyValue('--dsh-frame-top-clearance'),
+  )
+  return Number.isNaN(clearance) ? min : Math.max(min, clearance)
+}
diff --git a/packages/client/ui-primitives/src/useAnchoredMaxHeight.ts b/packages/client/ui-primitives/src/useAnchoredMaxHeight.ts
index 5f3bc52bab..d137b8b7c8 100644
--- a/packages/client/ui-primitives/src/useAnchoredMaxHeight.ts
+++ b/packages/client/ui-primitives/src/useAnchoredMaxHeight.ts
@@ -6,8 +6,12 @@
  */
 import { useLayoutEffect, useState } from 'react'
 import type { RefObject } from 'react'
+import { overlayTopMargin } from './overlay-top-margin.ts'
 
-/** Safe distance kept between the overlay and the viewport top edge (mirrors the Menu portal margin). */
+/**
+ * Safe distance kept between the overlay and the viewport top edge (mirrors
+ * the Menu portal margin); the frame's published top clearance widens it.
+ */
 const MARGIN = 12
 
 /**
@@ -16,15 +20,18 @@ const MARGIN = 12
  * @param cap - design max-height in px (the clamp never exceeds it).
  * @param signal - re-measure trigger: pass the overlay's render state so anchor
  *   moves (composer growth) re-fit; resize/scroll re-fit while mounted.
+ * @param margin - viewport top margin floor in px; the frame's published top
+ *   clearance widens it. Callers under fixed chrome (the conversation header)
+ *   raise it past their chrome's height.
  * @returns the max-height to apply inline, in px.
  */
-export function useAnchoredMaxHeight(ref: RefObject<HTMLElement>, cap: number, signal: unknown): number {
+export function useAnchoredMaxHeight(ref: RefObject<HTMLElement>, cap: number, signal: unknown, margin: number = MARGIN): number {
   const [maxHeight, setMaxHeight] = useState(cap)
   useLayoutEffect(() => {
     const el = ref.current
     if (el === null) return
     const fit = () => {
-      setMaxHeight(Math.min(cap, Math.max(0, el.getBoundingClientRect().bottom - MARGIN)))
+      setMaxHeight(Math.min(cap, Math.max(0, el.getBoundingClientRect().bottom - overlayTopMargin(margin))))
     }
     fit()
     window.addEventListener('resize', fit)
@@ -33,6 +40,6 @@ export function useAnchoredMaxHeight(ref: RefObject<HTMLElement>, cap: number, s
       window.removeEventListener('resize', fit)
       window.removeEventListener('scroll', fit, true)
     }
-  }, [ref, cap, signal])
+  }, [ref, cap, signal, margin])
   return maxHeight
 }
diff --git a/packages/client/ui-primitives/tests/use-anchored-max-height.client.spec.tsx b/packages/client/ui-primitives/tests/use-anchored-max-height.client.spec.tsx
new file mode 100644
index 0000000000..c6a243e2b8
--- /dev/null
+++ b/packages/client/ui-primitives/tests/use-anchored-max-height.client.spec.tsx
@@ -0,0 +1,58 @@
+// @vitest-environment jsdom
+/**
+ * `useAnchoredMaxHeight` clamps a bottom-anchored overlay to the space above
+ * its bottom edge, keeping a 12px viewport margin that widens to the frame's
+ * published `--dsh-frame-top-clearance` (the macOS window strip).
+ */
+import { useRef } from 'react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, render } from '@testing-library/react'
+import { useAnchoredMaxHeight } from '../src/useAnchoredMaxHeight.ts'
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+  document.documentElement.style.removeProperty('--dsh-frame-top-clearance')
+})
+
+/** Render the hook against an element whose bottom edge sits at `bottom`. */
+function Probe({ cap, margin }: { cap: number; margin?: number }) {
+  const ref = useRef<HTMLDivElement>(null)
+  const maxHeight = useAnchoredMaxHeight(ref, cap, 0, margin)
+  return <div ref={ref} data-testid="probe" data-max-height={maxHeight} />
+}
+
+/** Pin jsdom's zero-size layout to a fixed bottom edge. */
+function stubBottom(bottom: number): void {
+  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockReturnValue(
+    new DOMRect(0, bottom - 100, 200, 100),
+  )
+}
+
+describe('useAnchoredMaxHeight', () => {
+  it('clamps to the space above the bottom edge minus the 12px margin', () => {
+    stubBottom(300)
+    const { getByTestId } = render(<Probe cap={400} />)
+    expect(getByTestId('probe').dataset.maxHeight).toBe('288')
+  })
+
+  it('widens the margin to the frame top clearance when published', () => {
+    document.documentElement.style.setProperty('--dsh-frame-top-clearance', '48px')
+    stubBottom(300)
+    const { getByTestId } = render(<Probe cap={400} />)
+    expect(getByTestId('probe').dataset.maxHeight).toBe('252')
+  })
+
+  it('keeps a caller-raised margin over a published smaller clearance', () => {
+    document.documentElement.style.setProperty('--dsh-frame-top-clearance', '48px')
+    stubBottom(300)
+    const { getByTestId } = render(<Probe cap={400} margin={84} />)
+    expect(getByTestId('probe').dataset.maxHeight).toBe('216')
+  })
+
+  it('never exceeds the design cap', () => {
+    stubBottom(300)
+    const { getByTestId } = render(<Probe cap={100} />)
+    expect(getByTestId('probe').dataset.maxHeight).toBe('100')
+  })
+})
diff --git a/packages/client/ui-settings-general/src/client/SettingsRoot.module.css b/packages/client/ui-settings-general/src/client/SettingsRoot.module.css
index 39703e1b1c..783eea44a9 100644
--- a/packages/client/ui-settings-general/src/client/SettingsRoot.module.css
+++ b/packages/client/ui-settings-general/src/client/SettingsRoot.module.css
@@ -79,13 +79,16 @@
    One height for every section, taken from the viewport rather than the
    content: sections differ by hundreds of pixels (a settings list against the
    composition editor), and a content-sized panel would resize under the
-   pointer on every nav click. Whatever does not fit scrolls in `.options`. */
+   pointer on every nav click. Whatever does not fit scrolls in `.options`.
+   24px of air above and below, widened to the frame's published top clearance
+   (the macOS window strip, where clicks drag the window) on both sides so the
+   panel sits centered and clear of the strip. */
 .panel {
   position: relative;
   z-index: 1;
   display: flex;
   width: 800px;
-  height: min(800px, calc(100vh - 48px));
+  height: min(800px, calc(100vh - 2 * max(24px, var(--dsh-frame-top-clearance, 24px))));
   max-width: calc(100vw - 48px);
   border-radius: 32px;
   overflow: hidden;
@@ -234,3 +237,9 @@
   clip: rect(0 0 0 0);
   white-space: nowrap;
 }
+
+/* macOS: overlays covering the window drag bands must subtract themselves
+   (Electron app-regions are geometry, not stacking). */
+:global([data-platform='darwin']) .overlay {
+  -webkit-app-region: no-drag;
+}
diff --git a/packages/client/ui-settings-models/src/client/OnboardingModal.module.css b/packages/client/ui-settings-models/src/client/OnboardingModal.module.css
index 473cbc4813..5c5629567f 100644
--- a/packages/client/ui-settings-models/src/client/OnboardingModal.module.css
+++ b/packages/client/ui-settings-models/src/client/OnboardingModal.module.css
@@ -1,12 +1,13 @@
 .dialog {
   width: min(600px, 100%);
+  max-height: 100%;
   padding: 0;
 }
 
 .content {
   display: flex;
   flex-direction: column;
-  max-height: calc(100vh - 48px);
+  min-height: 0;
   padding: 28px;
   box-sizing: border-box;
   overflow-y: auto;
diff --git a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css
index 9afba72843..890b897cc8 100644
--- a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css
+++ b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.module.css
@@ -46,19 +46,37 @@
   transition: transform var(--ds-transition-duration-slow) var(--ds-ease-in-out);
 }
 
+/* One-frame app-region pulse at each open/close edge (RightbarSeat): changing
+   this computed value is what makes Electron recollect the window's drag
+   rects, which the slide's transform/visibility flips alone never dirty
+   (electron#32341). The panel's steady state sets no app-region in either
+   presentation, so this write is a real change at both edges — including a
+   hidden panel opening straight into fullscreen (a narrow window's first
+   open), whose rects were skipped while hidden. While set, the whole panel is
+   out of the drag band for that frame; the removal frame recollects the
+   steady-state geometry below. */
+:global(html[data-platform='darwin']) .panel[data-sidebar-right-region-nudge] {
+  -webkit-app-region: no-drag;
+}
+
 .panel[data-sidebar-right-panel='fullscreen'] {
   position: fixed;
   inset: 0;
   z-index: 40;
   border: none;
-  /* Electron drag regions are window geometry, not stacking: the conversation
-     title row's and the sidebar top strip's drag bands underneath keep taking
-     the pointer through this overlay, making the first strip's tabs unclickable.
-     The panel appears after both in DOM order, so this subtracts its whole box;
-     the strip rule below restores dragging on the strip's blank run. */
-  -webkit-app-region: no-drag;
 }
 
+/* No whole-box subtraction here: Electron drag regions are window geometry,
+   not stacking, so the frame's leading band does keep acting through this
+   fixed overlay — but the kit already subtracts every box that must stay
+   usable (tabs, strip-end chrome, pane bodies, dividers; ui-dockkit), and
+   ui-web base.css subtracts interactive elements and portalled overlays.
+   What remains of the band under the strips' blank runs is the window drag
+   affordance, the same native-tab-bar reading as the push presentation. A
+   panel-wide no-drag would trade it away and, worse, make no-drag the
+   steady state, turning the open/close pulse above into a computed-value
+   no-op exactly when a hidden panel opens straight into fullscreen. */
+
 /* Windows keeps caption controls above fullscreen file and terminal panels. */
 :global([data-windows-titlebar]) .panel[data-sidebar-right-panel='fullscreen'] {
   overflow: hidden;
@@ -84,14 +102,10 @@
   --dsh-dockkit-strip-inline-start: 10px;
 }
 
-/* Fullscreen keeps a window drag affordance on the tab strips' blank runs;
-   tabs and strip controls opt back out. */
-:global([data-platform='darwin']) .panel[data-sidebar-right-panel='fullscreen'] :global([data-dockkit-strip]) {
-  -webkit-app-region: drag;
-}
-
-:global([data-platform='darwin']) .panel[data-sidebar-right-panel='fullscreen'] :global([data-dockkit-strip]) > * {
-  -webkit-app-region: no-drag;
+/* Window fullscreen hides the traffic lights (html[data-fullscreen], desktop
+   preload); the first pane's strip keeps only the ordinary inset. */
+:global([data-platform='darwin'][data-fullscreen]) .panel[data-sidebar-right-panel='fullscreen'] .panelBody {
+  --dsh-dockkit-strip-inline-start: 10px;
 }
 
 @media (prefers-reduced-motion: reduce) {
diff --git a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx
index 1a517f4684..f326717124 100644
--- a/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx
+++ b/packages/client/ui-sidebar-right/src/client/shell/SidebarRight.tsx
@@ -374,6 +374,37 @@ export function RightbarSeat({
     if (shown && !fullscreen && !canShow) actions.setExpanded(sessionId, false)
   }, [actions, sessionId, shown, fullscreen, canShow])
 
+  // Electron rebuilds the window's -webkit-app-region rects only when a style
+  // or layout pass dirties an app-region value (electron#32341), and Blink
+  // skips hidden boxes when it collects them. The open/close slide flips only
+  // transform and visibility — neither dirties the rects — so the strip's
+  // no-drag boxes (ui-dockkit) are missing right after the first open, leaving
+  // the tabs under the window drag band (ui-layout .leadingBand) swallowed by
+  // it, and they would linger after a close. Pulsing an app-region rule
+  // (SidebarRight.module.css) on the panel forces a recollection at both edges
+  // of the gesture: once at the flip, once after the slide settles and the
+  // stylesheet's delayed visibility flip (0.3s) has landed.
+  useEffect(() => {
+    if (document.documentElement.dataset.platform !== 'darwin') return
+    const panel = panelRef.current
+    if (panel === null) return
+    let raf: number | null = null
+    const nudge = (): void => {
+      panel.setAttribute('data-sidebar-right-region-nudge', '')
+      raf = requestAnimationFrame(() => {
+        raf = null
+        panel.removeAttribute('data-sidebar-right-region-nudge')
+      })
+    }
+    nudge()
+    const settle = setTimeout(nudge, 400)
+    return () => {
+      clearTimeout(settle)
+      if (raf !== null) cancelAnimationFrame(raf)
+      panel.removeAttribute('data-sidebar-right-region-nudge')
+    }
+  }, [shown])
+
   // Fullscreen leaves the previous column report in force until its own slide
   // completes. Normal presentation and zero-duration transitions report before paint.
   useLayoutEffect(() => {
diff --git a/packages/client/ui-sidebar-right/tests/region-nudge-styles.client.spec.ts b/packages/client/ui-sidebar-right/tests/region-nudge-styles.client.spec.ts
new file mode 100644
index 0000000000..e095849e1d
--- /dev/null
+++ b/packages/client/ui-sidebar-right/tests/region-nudge-styles.client.spec.ts
@@ -0,0 +1,46 @@
+/**
+ * App-region nudge pulse, asserted against SidebarRight.module.css on disk:
+ * Electron recollects the window's drag rects only when a style pass changes
+ * a computed app-region value (electron#32341), so the panel's steady state
+ * must declare NO app-region in either presentation — the open/close no-drag
+ * pulse is then a real computed-value change at both edges, including a
+ * hidden panel opening straight into fullscreen (a narrow window's first
+ * open, whose rects were skipped while hidden). A steady-state value on the
+ * panel (the old fullscreen whole-box no-drag) makes the pulse a silent
+ * no-op and leaves the frame's drag band swallowing the strip's top-right
+ * controls; fine-grained subtraction belongs to ui-dockkit (tabs, strip-end
+ * chrome, pane bodies, dividers), leaving the strips' blank runs draggable.
+ */
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+const css = readFileSync(new URL('../src/client/shell/SidebarRight.module.css', import.meta.url), 'utf8')
+
+/**
+ * Every `<selector> -> value` pair of rules declaring `-webkit-app-region`.
+ * @returns one entry per declaring rule, in source order.
+ */
+function appRegionRules(): [selector: string, value: string][] {
+  const rules: [string, string][] = []
+  for (const match of css.matchAll(/(?<sel>[^{}]+)\{(?<body>[^{}]*)\}/g)) {
+    const value = /-webkit-app-region:\s*([^;]+);/.exec(match.groups!['body']!)?.[1]
+    if (value !== undefined) rules.push([match.groups!['sel']!.trim(), value.trim()])
+  }
+  return rules
+}
+
+describe('app-region nudge pulse styles', () => {
+  it('pulses the panel to no-drag', () => {
+    const pulses = appRegionRules()
+      .filter(([selector]) => selector.includes('[data-sidebar-right-region-nudge]'))
+    expect(pulses).toHaveLength(1)
+    expect(pulses[0]![0]).toMatch(/\.panel\[data-sidebar-right-region-nudge\]\s*$/)
+    expect(pulses[0]![1]).toBe('no-drag')
+  })
+
+  it('declares no steady-state app-region, so the pulse is a real change', () => {
+    const steady = appRegionRules()
+      .filter(([selector]) => !selector.includes('[data-sidebar-right-region-nudge]'))
+    expect(steady).toEqual([])
+  })
+})
diff --git a/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx b/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx
index 8a5db55190..322aa1d690 100644
--- a/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx
+++ b/packages/client/ui-sidebar-right/tests/seat.client.spec.tsx
@@ -210,6 +210,47 @@ describe('RightbarSeat presentation', () => {
     expect(h.frame.closeRightbar).toHaveBeenCalled()
   })
 
+  it('skips the nudge while the darwin seat has no surface to render', async () => {
+    // The seat's first render returns null (the open effect has not created
+    // the surface yet), so the nudge effect fires with an unattached panel ref.
+    document.documentElement.dataset.platform = 'darwin'
+    try {
+      const h = await mountSeat()
+      const panel = element(h.view.container, '[data-sidebar-right-panel]')
+      expect(panel.hasAttribute('data-sidebar-right-region-nudge')).toBe(false)
+    } finally {
+      delete document.documentElement.dataset.platform
+    }
+  })
+
+  it('pulses the app-region nudge at each open and close edge on macOS only', async () => {
+    const h = await mountSeat()
+    const panel = element(h.view.container, '[data-sidebar-right-panel]')
+    const marks = vi.spyOn(panel, 'setAttribute')
+    const nudges = () => marks.mock.calls.filter(([name]) => name === 'data-sidebar-right-region-nudge').length
+    // Web and Windows compose no app-regions: the slide needs no nudge.
+    act(() => { h.controller.toggleExpanded() })
+    act(() => { h.controller.toggleExpanded() })
+    expect(nudges()).toBe(0)
+    document.documentElement.dataset.platform = 'darwin'
+    try {
+      act(() => { h.controller.toggleExpanded() })
+      expect(nudges()).toBe(1)
+      expect(panel.hasAttribute('data-sidebar-right-region-nudge')).toBe(true)
+      // A frame later the mark lifts (the pulse itself is the recollection
+      // trigger), and the settle pulse re-marks after the 0.3s slide.
+      await act(async () => { await new Promise(resolve => setTimeout(resolve, 450)) })
+      expect(nudges()).toBe(2)
+      expect(panel.hasAttribute('data-sidebar-right-region-nudge')).toBe(false)
+      // The close edge pulses again so the hidden panel's stale rects drop.
+      act(() => { h.controller.toggleExpanded() })
+      expect(nudges()).toBe(3)
+      expect(panel.hasAttribute('data-sidebar-right-region-nudge')).toBe(true)
+    } finally {
+      delete document.documentElement.dataset.platform
+    }
+  })
+
   it('fills the viewport without replacing the content tree or releasing the wide track', async () => {
     const h = await mountSeat()
     const tab = h.open()
diff --git a/packages/client/ui-sidebar/README.i18n.yaml b/packages/client/ui-sidebar/README.i18n.yaml
index 74a544bbbe..c837437b74 100644
--- a/packages/client/ui-sidebar/README.i18n.yaml
+++ b/packages/client/ui-sidebar/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-sidebar/README.md
-README.md: 513e9d3151aba64b640475c3cd8c2f993df077db
-README.zh.md: 69050dc8c530bf4c794d42113f2679fe41891e5f
+README.md: 1c5306b8b3efa5d7908cfd33206acefef20fc3a8
+README.zh.md: d72da040252f391bcc1468c9e29adf6a5ef85ef0
diff --git a/packages/client/ui-sidebar/README.md b/packages/client/ui-sidebar/README.md
index 513e9d3151..1c5306b8b3 100644
--- a/packages/client/ui-sidebar/README.md
+++ b/packages/client/ui-sidebar/README.md
@@ -45,7 +45,7 @@ On Windows Electron, `html[data-windows-titlebar]` fixes the sidebar toggle in t
 
 ### macOS desktop
 
-Under `html[data-platform='darwin']` (set only by the desktop preload) the expanded column opens with a 52px top strip that clears the hiddenInset traffic lights, carries the collapse toggle, and acts as the window drag region; collapsing hides the column entirely instead of leaving the rail. The resident header remains mounted without a selected Session. The package registers `HeaderLeadingControls` into the conversation header's root-scoped `conversation.header.leading` seat — the open-sidebar and New Session controls shown, purely via CSS against the AppFrame-published `data-sidebar-collapsed` attribute, only while the column is hidden. Rationale and the window-integration contract: the [macOS hidden-titlebar Agent Note](../../../.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md).
+Under `html[data-platform='darwin']` (set only by the desktop preload) the expanded column opens with a 52px top strip that clears the hiddenInset traffic lights and carries the collapse toggle; the frame's own drag band (ui-layout `.leadingBand`) covers that strip, and the logo row below extends the drag surface, so the brand wordmark is not a New Session shortcut there — the dedicated New Session button keeps the action — and collapsing hides the column entirely instead of leaving the rail. The package registers `HeaderLeadingControls` into the frame's `shell.leading` window-chrome seat (ui-layout), which mounts it — the open-sidebar and New Session controls beside the traffic lights — only while the column is hidden, over every main panel. Rationale and the window-integration contract: the [macOS hidden-titlebar Agent Note](../../../.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.md).
 
 ### Scrollbars
 
diff --git a/packages/client/ui-sidebar/README.zh.md b/packages/client/ui-sidebar/README.zh.md
index 69050dc8c5..d72da04025 100644
--- a/packages/client/ui-sidebar/README.zh.md
+++ b/packages/client/ui-sidebar/README.zh.md
@@ -45,7 +45,7 @@ dsh Web 客户端的侧边栏让用户识别当前构建、启动新会话、将
 
 ### macOS 桌面
 
-在 `html[data-platform='darwin']`（仅由桌面 preload 设置）下，展开的侧边栏列顶部有一条 52px 的顶部条：避开 hiddenInset 红绿灯、承载收起按钮，并作为窗口拖拽区；收起时整列隐藏而非保留轨道。未选中会话时，常驻头部仍保持挂载。本包向会话头部的根作用域 `conversation.header.leading` 座注册 `HeaderLeadingControls`——打开侧边栏与 New Session 两个控件，纯由 CSS 依据 AppFrame 发布的 `data-sidebar-collapsed` 属性仅在列隐藏时显示。设计依据与窗口集成约定见 [macOS 隐藏标题栏 Agent Note](../../../.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md)。
+在 `html[data-platform='darwin']`（仅由桌面 preload 设置）下，展开的侧边栏列顶部有一条 52px 的顶部条：避开 hiddenInset 红绿灯并承载收起按钮；框架自身的拖拽带（ui-layout `.leadingBand`）覆盖这条顶部条，其下的 logo 行延伸这块拖拽面，因此品牌 wordmark 在 macOS 上不再是 New Session 快捷入口——专用的 New Session 按钮保留该操作；收起时整列隐藏而非保留轨道。本包向框架的 `shell.leading` 窗口 chrome 座（ui-layout）注册 `HeaderLeadingControls`——打开侧边栏与 New Session 两个控件，由框架仅在列隐藏时挂载于红绿灯旁，覆盖所有主面板。设计依据与窗口集成约定见 [macOS 隐藏标题栏 Agent Note](../../../.agents/notes/implemented/feature/2026-09-13-macos-hidden-titlebar-vibrancy.zh.md)。
 
 ### 滚动条
 
diff --git a/packages/client/ui-sidebar/package.json b/packages/client/ui-sidebar/package.json
index cb417bfdee..2b33960260 100644
--- a/packages/client/ui-sidebar/package.json
+++ b/packages/client/ui-sidebar/package.json
@@ -30,7 +30,6 @@
       "inject": [
         "@deepseek-ai/dsh-api-workspace-controller",
         "@deepseek-ai/dsh-client-ui-renderer",
-        "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-layout",
         "@deepseek-ai/dsh-client-ui-session",
         "@deepseek-ai/dsh-client-ui-workspace",
@@ -52,7 +51,6 @@
     "@deepseek-ai/dsh-client-locale": "workspace:^",
     "@deepseek-ai/dsh-client-store": "workspace:^",
     "@deepseek-ai/dsh-client-test-runtime": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-conversation": "workspace:^",
     "@deepseek-ai/dsh-client-ui-layout": "workspace:^",
     "@deepseek-ai/dsh-client-ui-primitives": "workspace:^",
     "@deepseek-ai/dsh-client-ui-renderer": "workspace:^",
diff --git a/packages/client/ui-sidebar/src/client/HeaderLeadingControls.module.css b/packages/client/ui-sidebar/src/client/HeaderLeadingControls.module.css
index ffbb01efc7..a8bced60bd 100644
--- a/packages/client/ui-sidebar/src/client/HeaderLeadingControls.module.css
+++ b/packages/client/ui-sidebar/src/client/HeaderLeadingControls.module.css
@@ -1,25 +1,12 @@
-/* Rendered only on macOS desktop (the component returns null elsewhere) and
-   shown only while the sidebar column is fully hidden: expanded, the sidebar
-   holds its own toggle/New Session and the traffic lights sit over the
-   column. */
+/* The frame's leadingSeat (ui-layout AppFrame) owns placement — position,
+   traffic-light clearance, no-drag; this box only lays out the two controls.
+   Same 8px rhythm as the conversation header's trailing controls
+   (ConversationRoot .headerUtilities/.headerCorner), so both ends of the
+   title row read as one control set. */
 .controls {
-  display: none;
-}
-
-/* Left padding clears the hiddenInset traffic lights: they span x 16..~68 in
-   window coordinates and the header already pads 20, so 68 lands the first
-   control at x 88 — a full control-width of air after the lights. Trailing
-   margin restores the leading seat's 8px gap to the breadcrumbs (the seat
-   itself carries none, so the empty expanded state adds no width). */
-:global([data-sidebar-collapsed]) .controls {
   display: flex;
   align-items: center;
-  /* Same 8px rhythm as the header's trailing controls (ConversationRoot
-     .headerUtilities/.headerCorner), so both ends of the title row read as one
-     control set. */
   gap: 8px;
-  padding-left: 68px;
-  margin-right: 8px;
 }
 
 .iconButton {
@@ -41,10 +28,3 @@
 .iconButton:hover {
   background: var(--dsw-alias-interactive-bg-hover);
 }
-
-/* Glyphs match the right-side header controls (ui-sidebar-right ExpandButton):
-   a 15px icon in the 28px circle. */
-.iconButton svg {
-  width: 15px;
-  height: 15px;
-}
diff --git a/packages/client/ui-sidebar/src/client/HeaderLeadingControls.tsx b/packages/client/ui-sidebar/src/client/HeaderLeadingControls.tsx
index 58ab8104a4..7c5fd0c56c 100644
--- a/packages/client/ui-sidebar/src/client/HeaderLeadingControls.tsx
+++ b/packages/client/ui-sidebar/src/client/HeaderLeadingControls.tsx
@@ -1,31 +1,29 @@
-/** macOS-desktop resident-header controls for the fully hidden sidebar. */
+/** Window-chrome controls for the fully hidden sidebar (frame shell.leading seat). */
 import {
-  IconNewChatOutlineRegular, IconPanelLeftOutlineRegular, isDarwinDesktop, Tooltip,
+  IconNewChatOutlineRegular, IconPanelLeftOutlineRegular, Tooltip,
 } from '@deepseek-ai/dsh-client-ui-primitives'
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
-// Type-only: pulls the conversation header slot declarations.
-import type {} from '@deepseek-ai/dsh-client-ui-conversation/client'
+// Type-only: pulls the frame's shell.leading slot declaration.
+import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
 import type { SidebarRootInjected } from './contract/slots.ts'
 import css from './HeaderLeadingControls.module.css'
 
-/** Full props of the resident-header leading occupant. */
+/** Full props of the shell.leading occupant. */
 export type HeaderLeadingControlsProps =
-  PropsRuntime<'conversation.header.leading'>
+  PropsRuntime<'shell.leading'>
   & InjectFace<SidebarRootInjected>
   & PropsLocale<'sidebar'>
 
 /**
- * Sidebar-open and New Session controls in the resident header's leading
- * seat. On macOS desktop a collapsed sidebar hides entirely (no rail), taking
- * both controls off screen; this occupant puts them back beside the traffic
- * lights. Mounted whenever the platform matches; visibility rides the
- * AppFrame-published `data-sidebar-collapsed` attribute in CSS, so no
- * collapse-state pipe is added here.
+ * Sidebar-open and New Session controls in the frame's window-chrome seat.
+ * On macOS desktop a collapsed sidebar hides entirely (no rail), taking both
+ * controls off screen; this occupant puts them back beside the traffic
+ * lights. The frame mounts the seat only in that state and owns its
+ * placement, so the occupant renders unconditionally.
  * @param props - Injected sidebar actions plus the sidebar locale seat.
- * @returns the two header controls, or null off macOS desktop.
+ * @returns the two window-chrome controls.
  */
 export function HeaderLeadingControls({ toggleSidebar, startSession, t }: HeaderLeadingControlsProps) {
-  if (!isDarwinDesktop()) return null
   return (
     <div className={css.controls}>
       <Tooltip label={t('toggle.open')} delayMs={500}>
diff --git a/packages/client/ui-sidebar/src/client/SidebarRoot.module.css b/packages/client/ui-sidebar/src/client/SidebarRoot.module.css
index 1309dd2322..144070ba3f 100644
--- a/packages/client/ui-sidebar/src/client/SidebarRoot.module.css
+++ b/packages/client/ui-sidebar/src/client/SidebarRoot.module.css
@@ -176,7 +176,8 @@
 
 /* macOS hiddenInset titlebar: the strip spans the column's top edge (negative
    margins cancel the root padding) so it clears the traffic lights at
-   (16, 18) and doubles as the window drag region; the toggle opts out. */
+   (16, 18). Window dragging over this run comes from ui-layout's .leadingBand
+   (same 52px geometry); the toggle subtracts via the base.css rule. */
 .topStrip {
   flex: none;
   display: flex;
@@ -185,12 +186,16 @@
   height: 52px;
   box-sizing: border-box;
   margin: -6px calc(-1 * var(--dsh-sidebar-inline-padding)) 0;
-  padding: 0 12px;
-  -webkit-app-region: drag;
+  /* The 2px foot centres the 28px toggle at y 25, level with the collapsed
+     seat (ui-layout .leadingSeat, top 11) and the conversation title row, so
+     collapse/expand never shifts it vertically. */
+  padding: 0 12px 2px;
 }
 
-.topStrip .iconButton {
-  -webkit-app-region: no-drag;
+/* Window fullscreen hides the traffic lights (html[data-fullscreen], desktop
+   preload): the toggle takes their spot at the strip's left edge. */
+:global([data-fullscreen]) .topStrip {
+  justify-content: flex-start;
 }
 
 /* The strip's full 52px foot leaves the wordmark too low; the content column
@@ -211,7 +216,7 @@
   gap: 8px;
   height: 60px;
   padding: 8px 0 8px 4px;
-  margin-bottom: 8px;
+  margin-bottom: 4px;
   box-sizing: border-box;
   overflow: hidden;
 }
@@ -223,6 +228,16 @@
   justify-content: flex-start;
 }
 
+/* macOS hiddenInset titlebar: the logo row extends the frame band's drag
+   below 52px, and the brand rides it — SidebarRoot renders the wordmark as a
+   plain span there, so the global interactive no-drag rule never subtracts
+   it; the dedicated New Session button below keeps the pointer and keyboard
+   paths. Safe as a drag source: it precedes the sidebar's overlay slots in
+   document order, so their no-drag still wins. */
+:global([data-platform='darwin']) .logoRow {
+  -webkit-app-region: drag;
+}
+
 /* Brand group (figma I133:7632): the full wordmark rides the text ink
    (figma flows: the main-screen instance is black; blue is brand
    emphasis only). A button only in behavior (New Session shortcut): the
@@ -240,6 +255,12 @@
   cursor: pointer;
 }
 
+/* On macOS the brand is a window-drag surface, not a New Session button;
+   a pointer cursor would promise a click that drags the window instead. */
+:global([data-platform='darwin']) .brand {
+  cursor: default;
+}
+
 /* Mark and name are independent slots; the shell owns their shared baseline,
    spacing, and height so either occupant can vary in width. */
 .brandIdentity {
@@ -390,15 +411,23 @@
   background: var(--dsw-alias-button-floating-hover);
 }
 
-/* macOS: the solid elevated fill reads as a foreign slab on the vibrancy
-   sidebar; letting a quarter of the material through keeps the card visible
-   while it sits in the glass. */
+/* macOS: the themed elevated fill reads as a foreign slab on the vibrancy
+   sidebar; a white wash sits in the glass like native macOS sidebar
+   controls. Dark keeps the same white ink at lower alpha. */
 :global([data-platform='darwin']) .newSession {
-  background: color-mix(in srgb, var(--dsw-alias-button-elevated-fill) 75%, transparent);
+  background: rgb(255 255 255 / 0.55);
 }
 
 :global([data-platform='darwin']) .newSession:hover {
-  background: color-mix(in srgb, var(--dsw-alias-button-floating-hover) 75%, transparent);
+  background: rgb(255 255 255 / 0.3);
+}
+
+:global([data-platform='darwin']) :global([data-ds-dark-theme]) .newSession {
+  background: rgb(255 255 255 / 0.15);
+}
+
+:global([data-platform='darwin']) :global([data-ds-dark-theme]) .newSession:hover {
+  background: rgb(255 255 255 / 0.2);
 }
 
 .collapsed .newSession {
diff --git a/packages/client/ui-sidebar/src/client/SidebarRoot.tsx b/packages/client/ui-sidebar/src/client/SidebarRoot.tsx
index 874e81ff3a..f58588feb1 100644
--- a/packages/client/ui-sidebar/src/client/SidebarRoot.tsx
+++ b/packages/client/ui-sidebar/src/client/SidebarRoot.tsx
@@ -206,15 +206,12 @@ export function SidebarRoot({
           traffic lights and keeps the toggle at the sidebar's top-right. */}
       {darwinDesktop && <div className={css.topStrip}>{toggle}</div>}
       <div className={css.logoRow}>
-        {/* Expanded, the brand doubles as a New Session shortcut; the
-            collapsed rail's logo is the expand toggle below instead. */}
-        {wide && (
-          <button
-            type="button"
-            className={clsx(css.brand, css.wide)}
-            aria-label={t('session.new.label')}
-            onClick={() => { startSession() }}
-          >
+        {/* Expanded, the brand doubles as a New Session shortcut — except on
+            macOS, where it stays part of the logo row's window-drag surface
+            (a button would subtract itself through the global no-drag rule);
+            the collapsed rail's logo is the expand toggle below instead. */}
+        {wide && (() => {
+          const identity = (
             <span className={css.brandIdentity} aria-hidden="true">
               <span className={css.brandMark}>
                 {renderSlot('sidebar.brand.mark', { size: 24 }, { fallback: <FishLogo size={24} /> })}
@@ -232,8 +229,20 @@ export function SidebarRoot({
                 })}
               </span>
             </span>
-          </button>
-        )}
+          )
+          return darwinDesktop
+            ? <span className={clsx(css.brand, css.wide)}>{identity}</span>
+            : (
+              <button
+                type="button"
+                className={clsx(css.brand, css.wide)}
+                aria-label={t('session.new.label')}
+                onClick={() => { startSession() }}
+              >
+                {identity}
+              </button>
+            )
+        })()}
         {!darwinDesktop && toggle}
       </div>
 
diff --git a/packages/client/ui-sidebar/src/client/index.ts b/packages/client/ui-sidebar/src/client/index.ts
index f1e3a38ce1..90c2e3eff6 100644
--- a/packages/client/ui-sidebar/src/client/index.ts
+++ b/packages/client/ui-sidebar/src/client/index.ts
@@ -9,8 +9,6 @@ import type {} from '@deepseek-ai/dsh-client-locale/client'
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 // Type-only: pulls the Session root standard-props merge.
 import type {} from '@deepseek-ai/dsh-client-ui-session/client'
-// Type-only: pulls the conversation header slot declarations.
-import type {} from '@deepseek-ai/dsh-client-ui-conversation/client'
 import type { SidebarPanelMetadata, SidebarRootInjected } from './contract/slots.ts'
 import { HeaderLeadingControls } from './HeaderLeadingControls.tsx'
 import { SidebarRoot } from './SidebarRoot.tsx'
@@ -86,11 +84,11 @@ export function apply(ctx: ClientContext): void {
     inject: injectProps,
   }, SidebarRoot))
   // macOS desktop hides the collapsed sidebar entirely, so the open/New
-  // Session controls move into the conversation header's leading seat; the
-  // occupant reuses the shell's injected actions and shows itself purely
-  // through CSS against the AppFrame's data-sidebar-collapsed attribute.
-  ctx.slots.inject('conversation.header.leading', () => ctx.slots.register({
-    name: 'conversation.header.leading',
+  // Session controls move into the frame's window-chrome seat beside the
+  // traffic lights; the occupant reuses the shell's injected actions, and
+  // the AppFrame mounts the seat only while the column is fully hidden.
+  ctx.slots.inject('shell.leading', () => ctx.slots.register({
+    name: 'shell.leading',
     locale: NS,
     inject: injectProps,
   }, HeaderLeadingControls))
diff --git a/packages/client/ui-sidebar/tests/apply.client.spec.tsx b/packages/client/ui-sidebar/tests/apply.client.spec.tsx
index fbe1bfd57a..1ded10bc47 100644
--- a/packages/client/ui-sidebar/tests/apply.client.spec.tsx
+++ b/packages/client/ui-sidebar/tests/apply.client.spec.tsx
@@ -42,7 +42,7 @@ async function bench(declare = true) {
       { name: 'root', children: {
         'sidebar': { kind: 'single', scope: 'root' },
         'main': { kind: 'keyed', scope: 'root' },
-        'conversation.header.leading': { kind: 'single', scope: 'root' },
+        'shell.leading': { kind: 'single', scope: 'root' },
       } },
       SidebarFrame,
     )
@@ -71,8 +71,8 @@ describe('ui-sidebar apply', () => {
     expect(b.slots.spec('sidebar.panellist')).toEqual({ kind: 'list', scope: 'root' })
     // Copy rides the standard locale seat, not the inject face.
     expect(b.slots.entries('sidebar')[0]!.locale).toBe('sidebar')
-    // The header leading occupant reuses the shell's inject face and locale.
-    const leading = b.slots.entries('conversation.header.leading')
+    // The window-chrome occupant reuses the shell's inject face and locale.
+    const leading = b.slots.entries('shell.leading')
     expect(leading).toHaveLength(1)
     expect(leading[0]!.component).toBe(HeaderLeadingControls)
     expect(leading[0]!.locale).toBe('sidebar')
@@ -145,7 +145,7 @@ describe('ui-sidebar apply', () => {
     await fiber.await()
     await fiber.dispose()
     expect(b.slots.entries('sidebar')).toHaveLength(0)
-    expect(b.slots.entries('conversation.header.leading')).toHaveLength(0)
+    expect(b.slots.entries('shell.leading')).toHaveLength(0)
     expect(b.slots.spec('sidebar.brand.mark')).toBeUndefined()
     expect(b.slots.spec('sidebar.brand.name')).toBeUndefined()
     expect(b.slots.spec('sidebar.workspaces')).toBeUndefined()
diff --git a/packages/client/ui-sidebar/tests/sidebar-root.client.spec.tsx b/packages/client/ui-sidebar/tests/sidebar-root.client.spec.tsx
index ed35997338..18e7fbc5e1 100644
--- a/packages/client/ui-sidebar/tests/sidebar-root.client.spec.tsx
+++ b/packages/client/ui-sidebar/tests/sidebar-root.client.spec.tsx
@@ -226,19 +226,20 @@ it('keeps the macOS sidebar toggle in its top strip', () => {
   const shell = mountShell()
   fireEvent.click(screen.getByRole('button', { name: en['toggle.collapse'] }))
   expect(shell.toggleSidebar).toHaveBeenCalledOnce()
+  // The brand stays part of the logo row's window-drag surface: no button
+  // role (the global no-drag rule would subtract it); only the dedicated
+  // New Session capsule starts a session.
+  expect(screen.getAllByRole('button', { name: 'New session' })).toHaveLength(1)
+  expect(screen.getByTestId('custom-brand-mark')).toBeTruthy()
 })
 
-it.each([undefined, 'win32', 'linux', 'darwin'])('shows header sidebar controls only on macOS desktop (%s)', (platform) => {
-  if (platform !== undefined) document.documentElement.dataset.platform = platform
+it('wires the shell.leading controls to the shared sidebar actions', () => {
   const toggleSidebar = vi.fn()
   const startSession = vi.fn()
-  // This occupant only consumes its two actions and locale, not Session hooks.
+  // This occupant only consumes its two actions and locale, not Session hooks;
+  // mounting is the frame's decision (ui-layout shell.leading seat).
   const props = { toggleSidebar, startSession, t } as HeaderLeadingControlsProps
-  const view = render(<HeaderLeadingControls {...props} />)
-  if (platform !== 'darwin') {
-    expect(view.container.innerHTML).toBe('')
-    return
-  }
+  render(<HeaderLeadingControls {...props} />)
   fireEvent.click(screen.getByRole('button', { name: en['toggle.open'] }))
   fireEvent.click(screen.getByRole('button', { name: en['session.new.label'] }))
   expect(toggleSidebar).toHaveBeenCalledOnce()
diff --git a/packages/client/ui-sidebar/tsconfig.json b/packages/client/ui-sidebar/tsconfig.json
index 8380d30342..5d20bd9741 100644
--- a/packages/client/ui-sidebar/tsconfig.json
+++ b/packages/client/ui-sidebar/tsconfig.json
@@ -23,9 +23,6 @@
     {
       "path": "../ui-primitives"
     },
-    {
-      "path": "../ui-conversation"
-    },
     {
       "path": "../ui-renderer"
     },
diff --git a/packages/client/ui-theme/tests/app-region-styles.client.spec.ts b/packages/client/ui-theme/tests/app-region-styles.client.spec.ts
new file mode 100644
index 0000000000..298764a7a8
--- /dev/null
+++ b/packages/client/ui-theme/tests/app-region-styles.client.spec.ts
@@ -0,0 +1,75 @@
+/**
+ * Window drag-region ownership, asserted against the CSS text on disk:
+ * `-webkit-app-region: drag` appears only in the two chrome bands that mount
+ * before all content — ui-layout's frame band and ui-sidebar's logo row.
+ * Electron composes app-regions from window geometry in DOM order, ignoring
+ * stacking: a drag rule on a content container overrides the no-drag of any
+ * overlay mounted earlier, so its controls drag the window instead of
+ * receiving clicks. Everything interactive opts out through ui-web base.css.
+ */
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { packageStylesheets, parseRules } from './stylesheet-scan.ts'
+
+/** The only stylesheets allowed to declare a window drag region, relative to packages/. */
+const DRAG_OWNERS = [
+  'client/ui-layout/src/client/AppFrame.module.css',
+  'client/ui-sidebar/src/client/SidebarRoot.module.css',
+]
+
+/**
+ * Selectors of rules declaring a window drag region. Matches the prefixed and
+ * unprefixed property and tolerates `!important`, so a creative spelling
+ * cannot slip a drag surface past the allowlist.
+ * @param css - stylesheet text.
+ * @returns the declaring selectors, in source order.
+ */
+function dragSelectors(css: string): string[] {
+  return parseRules(css)
+    .filter(rule => rule.declarations
+      .some(([property, value]) => /^(-webkit-)?app-region$/.test(property) && /^drag(\s|!|$)/.test(value)))
+    .map(rule => rule.selectors.join(', '))
+}
+
+/**
+ * Allowlist violations across a stylesheet set.
+ * @param files - stylesheet paths to scan.
+ * @param read - returns one stylesheet's text.
+ * @returns `path selectors` for each drag rule outside DRAG_OWNERS.
+ */
+function offenders(files: string[], read: (file: string) => string): string[] {
+  return files
+    .filter(file => !DRAG_OWNERS.some(owner => file.endsWith(`/${owner}`)))
+    .flatMap(file => dragSelectors(read(file)).map(selectors => `${file} ${selectors}`))
+}
+
+describe('window drag-region ownership', () => {
+  it('rejects a drag declaration and passes no-drag', () => {
+    expect(dragSelectors('.a { -webkit-app-region: drag; }')).toEqual(['.a'])
+    expect(dragSelectors('.a { -webkit-app-region: drag !important; }')).toEqual(['.a'])
+    expect(dragSelectors('.a { app-region: drag; }')).toEqual(['.a'])
+    expect(dragSelectors('.a { -webkit-app-region: no-drag; }')).toEqual([])
+    expect(dragSelectors('.a { app-region: no-drag !important; }')).toEqual([])
+  })
+
+  it('reports a drag rule outside the allowlist and exempts the owners', () => {
+    const drag = '.evil { -webkit-app-region: drag; }'
+    // Fixture path avoids the packages/ prefix: verify-package-paths checks such references against disk.
+    expect(offenders(['/elsewhere/client/ui-evil/src/client/Evil.module.css'], () => drag))
+      .toEqual(['/elsewhere/client/ui-evil/src/client/Evil.module.css .evil'])
+    expect(offenders([`/packages/${DRAG_OWNERS[0]!}`], () => drag)).toEqual([])
+  })
+
+  it('keeps -webkit-app-region: drag inside the two chrome bands', () => {
+    expect(offenders(packageStylesheets(), file => readFileSync(file, 'utf8'))).toEqual([])
+  })
+
+  it('still finds a drag band in every allowlisted owner', () => {
+    // An owner that stops declaring drag should leave the allowlist with it.
+    for (const owner of DRAG_OWNERS) {
+      const file = packageStylesheets().find(candidate => candidate.endsWith(`/${owner}`))
+      expect(file, owner).toBeDefined()
+      expect(dragSelectors(readFileSync(file!, 'utf8')), owner).not.toEqual([])
+    }
+  })
+})
diff --git a/packages/client/ui-theme/tests/elevation-styles.client.spec.ts b/packages/client/ui-theme/tests/elevation-styles.client.spec.ts
index ade17f1f06..01d704a723 100644
--- a/packages/client/ui-theme/tests/elevation-styles.client.spec.ts
+++ b/packages/client/ui-theme/tests/elevation-styles.client.spec.ts
@@ -113,7 +113,7 @@ describe('translucent menu surfaces pair fill and filter', () => {
     ] as const
     const files = packageStylesheets()
     for (const [suffix, container, background] of surfaces) {
-      const file = files.find(candidate => candidate.replaceAll('\\', '/').endsWith(suffix))
+      const file = files.find(candidate => candidate.endsWith(suffix))
       expect(file, suffix).toBeDefined()
       const rules = parseRules(readFileSync(file!, 'utf8'))
       const declarations = (selector: string) => new Map(rules
diff --git a/packages/client/ui-theme/tests/scrollbar-styles.client.spec.ts b/packages/client/ui-theme/tests/scrollbar-styles.client.spec.ts
index 48a49786cc..297ea5b7d7 100644
--- a/packages/client/ui-theme/tests/scrollbar-styles.client.spec.ts
+++ b/packages/client/ui-theme/tests/scrollbar-styles.client.spec.ts
@@ -15,6 +15,10 @@ import { atRuleBlock, type CssRule, packageStylesheets, parseRules, varReference
 
 const STYLES = new URL('../src/styles/', import.meta.url)
 const read = (name: string): string => readFileSync(fileURLToPath(new URL(name, STYLES)), 'utf8')
+/* packageStylesheets() paths are /-separated on every platform; match them
+   with the same separator or the exclusion silently stops applying on
+   Windows. */
+const SCROLLBAR_SHEET = fileURLToPath(new URL('scrollbar.css', STYLES)).replaceAll('\\', '/')
 
 const platformCss = read('design-platform.css')
 const scrollbarCss = read('scrollbar.css')
@@ -190,7 +194,7 @@ for (const file of packageStylesheets()) {
     let rebindsElevation = false
     const ruleSurfaces: string[] = []
     for (const [property, value] of rule.declarations) {
-      if (COLOUR_INDIRECTIONS.has(property) && file !== fileURLToPath(new URL('scrollbar.css', STYLES))) {
+      if (COLOUR_INDIRECTIONS.has(property) && file !== SCROLLBAR_SHEET) {
         rebinds = true
         if (value !== HIDDEN_THUMB) rebindsElevation = true
       }
@@ -314,7 +318,7 @@ describe('scrollbar.css geometry variables', () => {
     expect(defined).toContain(WIDTH_VARIABLE)
     const readers: string[] = []
     for (const file of packageStylesheets()) {
-      if (file === fileURLToPath(new URL('scrollbar.css', STYLES))) continue
+      if (file === SCROLLBAR_SHEET) continue
       for (const rule of parseRules(readFileSync(file, 'utf8'))) {
         for (const [property, value] of rule.declarations) {
           for (const name of varReferences(value)) {
diff --git a/packages/client/ui-theme/tests/stylesheet-scan.ts b/packages/client/ui-theme/tests/stylesheet-scan.ts
index d91e308889..c658a21254 100644
--- a/packages/client/ui-theme/tests/stylesheet-scan.ts
+++ b/packages/client/ui-theme/tests/stylesheet-scan.ts
@@ -74,7 +74,8 @@ export function varReferences(value: string): string[] {
 /**
  * Every CSS file shipped as package source, excluding build output and
  * installed dependencies.
- * @returns absolute paths of the stylesheets under packages/.
+ * @returns absolute stylesheet paths under packages/, `/`-separated on every
+ *   platform so specs can match repo-relative suffixes verbatim.
  */
 export function packageStylesheets(): string[] {
   const found: string[] = []
@@ -83,7 +84,7 @@ export function packageStylesheets(): string[] {
       const path = join(dir, entry.name)
       if (entry.isDirectory()) {
         if (entry.name !== 'node_modules' && entry.name !== 'lib' && entry.name !== 'dist') walk(path)
-      } else if (entry.name.endsWith('.css')) found.push(path)
+      } else if (entry.name.endsWith('.css')) found.push(path.replaceAll('\\', '/'))
     }
   }
   walk(PACKAGES_DIR)
diff --git a/packages/client/web/src/base.css b/packages/client/web/src/base.css
index 10616bba3b..805a74e9fb 100644
--- a/packages/client/web/src/base.css
+++ b/packages/client/web/src/base.css
@@ -39,6 +39,46 @@ html[data-platform='darwin'] body {
   background: transparent;
 }
 
+/* The transparent window disables backdrop-filter: Chromium composites it
+   against the root surface, which vibrancy leaves transparent, so the blur in
+   --dsw-menu-backdrop-filter renders as nothing and half-opaque menu fills
+   let underlying text bleed through. Compensate with near-opaque fills on the
+   same design-platform hues (light 248 249 250 / dark 48 49 54). */
+html[data-platform='darwin'] body {
+  --dsw-specific-menu: rgba(248, 249, 250, 0.94);
+}
+
+html[data-platform='darwin'] body[data-ds-dark-theme] {
+  --dsw-specific-menu: rgba(48, 49, 54, 0.94);
+}
+
+/* macOS desktop: the app frame publishes window drag bands, and Electron
+   composes app-regions from geometry, not hit testing — a surface covering a
+   band would otherwise drag the window instead of receiving clicks. Every
+   overlay portals to document.body beside #root, so one rule subtracts them
+   all; drag surfaces all live inside #root. */
+html[data-platform='darwin'] body > :not(#root) {
+  -webkit-app-region: no-drag;
+}
+
+/* Inside #root, interactive controls and raised surfaces (dialogs, menus)
+   subtract themselves from any drag band they overlap, wherever they render.
+   Electron composes app-regions from geometry in document order, so this works
+   only because the bands are declared before all content (AppFrame's first
+   child; the sidebar rows that precede the column's overlay slots) — a drag
+   rule on a content container would override every overlay mounted earlier in
+   the DOM. One selector on the native elements, ARIA roles, and tabindexed
+   custom widgets replaces per-component no-drag opt-outs. */
+html[data-platform='darwin'] :is(
+  button, a, input, select, textarea, summary, [contenteditable='true'], [tabindex],
+  [role='dialog'], [role='alertdialog'], [role='menu'], [role='listbox'], [role='tooltip'],
+  [role='button'], [role='link'], [role='tab'], [role='menuitem'], [role='menuitemcheckbox'],
+  [role='menuitemradio'], [role='option'], [role='checkbox'], [role='radio'], [role='switch'],
+  [role='slider'], [role='combobox'], [role='textbox']
+) {
+  -webkit-app-region: no-drag;
+}
+
 code,
 pre,
 [data-diff],
diff --git a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
index 487dea1160..44dd4aa8fb 100644
--- a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
+++ b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
@@ -562,10 +562,8 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     hookContext: '',
     slotInject: '',
     declaredBy: 'an entry in \'conversation.header\' (client-ui-conversation), so it exists while that entry is mounted',
-    occupants: [
-      'client-ui-sidebar HeaderLeadingControls',
-    ],
-    replaceRisk: 'shadows-shipped-ui',
+    occupants: [],
+    replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.header.leading\', () => ctx.slots.register(\n      { name: \'conversation.header.leading\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
     source: 'packages/client/ui-conversation/src/client/contract/slots.ts:164',
   },
@@ -2305,6 +2303,35 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'settings.trigger\', () => ctx.slots.register(\n      { name: \'settings.trigger\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
     source: 'packages/client/ui-settings/src/client/contract/slots.ts:24',
   },
+  {
+    key: 'shell.leading',
+    kind: 'single',
+    scope: 'root',
+    summary: 'Window-chrome seat at the frame\'s top-left, over every main panel.',
+    doc: 'Window-chrome seat at the frame\'s top-left, over every main panel.\nMounted only while the sidebar column is fully hidden (macOS desktop\ncollapse; other platforms keep the rail), so the occupant can assume the\nframe edge is the window edge and the macOS traffic lights sit before it.\nOCCUPIED by ui-sidebar\'s reopen/New Session controls.\n\nWhile the seat is mounted the frame publishes\n`--dsh-frame-leading-clearance` (the inline inset the seat\'s band\noccupies, measured from the frame\'s left edge); a main panel whose\ncontent reaches the top-left corner pads by it so nothing lands under\nthe lights or the controls.',
+    registerOptions: [],
+    ownerProps: [],
+    ownerPropsReferences: [],
+    standardProps: [
+      'useResource: UseResource',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+      'usePanelInfo: UsePanelInfo',
+      'useSessions: UseSessions',
+      'useSessionStatus: UseSessionStatus',
+      'useSessionRetainInfo: UseSessionRetainInfo',
+      'useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>',
+    ],
+    keyDomain: '',
+    hookContext: '',
+    slotInject: '',
+    declaredBy: 'an entry in \'root\' (client-ui-layout), so it exists while that entry is mounted',
+    occupants: [
+      'client-ui-sidebar HeaderLeadingControls',
+    ],
+    replaceRisk: 'shadows-shipped-ui',
+    example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'shell.leading\', () => ctx.slots.register(\n      { name: \'shell.leading\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
+    source: 'packages/client/ui-layout/src/client/index.ts:105',
+  },
   {
     key: 'shell.overlay',
     kind: 'list',
diff --git a/packages/llm/plugin-package-inventory-deepseek/README.i18n.yaml b/packages/llm/plugin-package-inventory-deepseek/README.i18n.yaml
index 894ccfeb5b..d5accc6249 100644
--- a/packages/llm/plugin-package-inventory-deepseek/README.i18n.yaml
+++ b/packages/llm/plugin-package-inventory-deepseek/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/llm/plugin-package-inventory-deepseek/README.md
-README.md: 4da84873844722aa4fb2ec2ed28984cfe8ec4c88
-README.zh.md: 69d2717c0e44c65754e3c05bb6f89f9c7d9a3060
+README.md: 72af2b9e6263499e3826b4ac31485f4df72af745
+README.zh.md: e1e5189239f7a1e72e954fc9f9ae39eac725d96c
diff --git a/packages/llm/plugin-package-inventory-deepseek/README.md b/packages/llm/plugin-package-inventory-deepseek/README.md
index 4da8487384..72af2b9e62 100644
--- a/packages/llm/plugin-package-inventory-deepseek/README.md
+++ b/packages/llm/plugin-package-inventory-deepseek/README.md
@@ -35,7 +35,7 @@ Shipped profiles use the default, so every official DeepSeek request carries the
 
 Every request re-reads active non-group entries from the host Loader tree. When optional `ctx.agentPresets` is present and `sessionId` resolves to a live Agent joined to a standing preset, that preset's separate Loader tree joins the same collection; deployments without the service report the host tree only. Entries are included only while their root fiber is `ACTIVE` and their effective Loader state is enabled.
 
-At activation, the plugin samples the optional `ctx.pluginPackages` service. Shipped app boot mounts that service before profile Loader entries, so bare package and package-subpath identities use the same authoritative generation as their imports, including generation misses, without requiring a `./package.json` export. If the service is absent, the plugin retains native Node package-search lookup for its lifetime and does not switch an existing inventory when a resolver mounts later. A low-level embedder that wants runtime-generation identities must therefore mount `PluginPackages` before both the Loader entries and this plugin.
+At activation, the plugin samples the optional `ctx.pluginPackages` service. Shipped app boot mounts that service before profile Loader entries, so bare package and package-subpath identities use the same authoritative runtime resolution as their imports, including its misses, without requiring a `./package.json` export. If the service is absent, the plugin retains native Node package-search lookup for its lifetime and does not switch an existing inventory when a resolver mounts later. A low-level embedder that wants runtime resolution identities must therefore mount `PluginPackages` before both the Loader entries and this plugin.
 
 Each ordinary entry uses its owning Loader tree base. A standing preset's root entries use the harness base, matching the preset Loader's deliberate bare-package override; nested includes retain their own bases. Relative and absolute modules walk to their nearest manifest; a manifest without `name` marks a loose module and contributes no package identity. A named package manifest must also declare a non-empty `version`, and malformed package metadata fails request preparation. Exact name/version pairs are deduplicated and sorted with a locale-independent comparison, while simultaneously active different versions remain separate.
 
diff --git a/packages/llm/plugin-package-inventory-deepseek/README.zh.md b/packages/llm/plugin-package-inventory-deepseek/README.zh.md
index 69d2717c0e..e1e5189239 100644
--- a/packages/llm/plugin-package-inventory-deepseek/README.zh.md
+++ b/packages/llm/plugin-package-inventory-deepseek/README.zh.md
@@ -35,7 +35,7 @@ kind: "package-reference"
 
 每次请求都会重读宿主 Loader 树中的活跃非 group 配置项。存在可选 `ctx.agentPresets` 且 `sessionId` 解析到已加入 standing preset 的存活 Agent 时，该 preset 的独立 Loader 树也会加入同一次收集；未挂载该服务的部署只报告宿主树。只有根 fiber 处于 `ACTIVE` 且 Loader 有效状态为启用的配置项才会纳入。
 
-插件在激活时读取一次可选的 `ctx.pluginPackages` 服务。随附 app boot 会在 profile Loader 配置项之前挂载该服务，因此裸包和包子路径的身份使用与其 import 相同的权威 generation，包括 generation 未命中，并且无需包导出 `./package.json`。若该服务不存在，插件会在整个生命周期中保留 Node 原生包搜索，之后再挂载 resolver 也不会切换既有清单。因此，希望使用 runtime generation 身份的底层嵌入方必须先挂载 `PluginPackages`，再挂载 Loader 配置项和本插件。
+插件在激活时读取一次可选的 `ctx.pluginPackages` 服务。随附 app boot 会在 profile Loader 配置项之前挂载该服务，因此裸包和包子路径的身份使用与其 import 相同的权威 runtime resolution，包括它未命中的情况，并且无需包导出 `./package.json`。若该服务不存在，插件会在整个生命周期中保留 Node 原生包搜索，之后再挂载 resolver 也不会切换既有清单。因此，希望使用 runtime resolution 身份的底层嵌入方必须先挂载 `PluginPackages`，再挂载 Loader 配置项和本插件。
 
 每个普通配置项使用其所属 Loader 树的基址。standing preset 的根配置项使用宿主基址，与 preset Loader 对裸包的显式覆写保持一致；嵌套 include 仍使用自身基址。相对与绝对模块会向上查找最近的 manifest（元数据清单）；没有 `name` 的 manifest 只标记松散模块，不贡献包身份。具名包 manifest 还必须声明非空 `version`，格式错误的包元数据会使请求准备失败。系统使用与 locale 无关的比较按确切名称／版本对去重并排序，同时存活的不同版本仍会分开保留。
 
diff --git a/packages/test-support/loader-smoke/README.i18n.yaml b/packages/test-support/loader-smoke/README.i18n.yaml
index 9282919ca3..e06664e1d3 100644
--- a/packages/test-support/loader-smoke/README.i18n.yaml
+++ b/packages/test-support/loader-smoke/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/test-support/loader-smoke/README.md
-README.md: 160c2ce03f7efdadd26ee4d2f922de859c2a5986
-README.zh.md: 2baf69fab5650ec2b84d48272e5fb2864a8afcbb
+README.md: 2bdee79f8e6d769f9713466128c931d749fc6950
+README.zh.md: ba83f0def2be1a77c7d2514b9c7b9ed76b3ec0ad
diff --git a/packages/test-support/loader-smoke/README.md b/packages/test-support/loader-smoke/README.md
index 160c2ce03f..2bdee79f8e 100644
--- a/packages/test-support/loader-smoke/README.md
+++ b/packages/test-support/loader-smoke/README.md
@@ -45,7 +45,7 @@ Set `sourceImport: 'tsx/esm'` when a source smoke exercises the supported `dsh`
 
 ### Testing a shipped profile
 
-Profile integration drivers use the repository-only `tests/fixtures/production-profile.ts` helper. It loads the named shipped profile and its bundle patches through `loadProfile`, materializes the retained link-mode fallback, mounts `PluginPackages` with native lookup as the link-mode launcher does, and passes the bundle patches followed by the test's `*.patch.yml` files to the root `cordis:include` mounted by `boot`. Those patches should contain only the test provider or model, isolated persistence paths, and subject-specific changes. Package-level unit tests that need an agent loop without profile integration mount `dsh-agent-loop-testkit` locally instead.
+Profile integration drivers use the repository-only `tests/fixtures/production-profile.ts` helper. It loads the named shipped profile and its bundle patches through `loadProfile`, computes the runtime resolution, installs it through `PluginPackages`, and passes the bundle patches followed by the test's `*.patch.yml` files to the root `cordis:include` mounted by `boot`. Those patches should contain only the test provider or model, isolated persistence paths, and subject-specific changes. Package-level unit tests that need an agent loop without profile integration mount `dsh-agent-loop-testkit` locally instead.
 
 ### Driving a fixture turn
 
diff --git a/packages/test-support/loader-smoke/README.zh.md b/packages/test-support/loader-smoke/README.zh.md
index 2baf69fab5..ba83f0def2 100644
--- a/packages/test-support/loader-smoke/README.zh.md
+++ b/packages/test-support/loader-smoke/README.zh.md
@@ -45,7 +45,7 @@ const result = await runLoaderSmoke({
 
 ### 测试交付 profile
 
-Profile 集成 driver 使用仅限仓库内部的 `tests/fixtures/production-profile.ts` helper。它通过 `loadProfile` 加载指定的已交付 profile 及其组合包 patch，物化保留的 link-mode fallback，并像 link-mode launcher 一样挂载使用原生查询的 `PluginPackages`，然后把组合包 patch 与测试 `*.patch.yml` 文件依次交给 `boot` 挂载的根 `cordis:include`。这些 patch 应只包含测试提供方或模型、隔离持久化路径及被测对象专用变更。只需要 agent loop 而不测试 profile 集成的包级单元测试改为在本地挂载 `dsh-agent-loop-testkit`。
+Profile 集成 driver 使用仅限仓库内部的 `tests/fixtures/production-profile.ts` helper。它通过 `loadProfile` 加载指定的已交付 profile 及其组合包 patch，计算 runtime resolution，并通过 `PluginPackages` 安装它，然后把组合包 patch 与测试 `*.patch.yml` 文件依次交给 `boot` 挂载的根 `cordis:include`。这些 patch 应只包含测试提供方或模型、隔离持久化路径及被测对象专用变更。只需要 agent loop 而不测试 profile 集成的包级单元测试改为在本地挂载 `dsh-agent-loop-testkit`。
 
 ### 驱动 fixture 轮次
 
diff --git a/packages/test-support/loader-smoke/tests/fixtures/production-profile.ts b/packages/test-support/loader-smoke/tests/fixtures/production-profile.ts
index dabe5bd735..c42345732a 100644
--- a/packages/test-support/loader-smoke/tests/fixtures/production-profile.ts
+++ b/packages/test-support/loader-smoke/tests/fixtures/production-profile.ts
@@ -9,7 +9,7 @@ import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
 import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
 import {
   boot,
-  healProfilesModuleFallback,
+  createRuntimeResolution,
   loadOverlayPatches,
   loadProfile,
   PluginPackages,
@@ -86,7 +86,7 @@ export async function bootProductionProfile(options: ProductionProfileOptions):
   const moduleLayers = options.overlayPaths.flatMap((path, index) => (
     overlayModuleLayers(path, overlays[index] ?? [])
   ))
-  await healProfilesModuleFallback({
+  const resolution = await createRuntimeResolution({
     installAnchor,
     profile: { ...profile, layers: [...profile.layers, ...moduleLayers] },
   })
@@ -98,7 +98,7 @@ export async function bootProductionProfile(options: ProductionProfileOptions):
       ...overlays.flat(),
     ],
     async (ctx) => {
-      await ctx.plugin(PluginPackages, {})
+      await ctx.plugin(PluginPackages, { resolution })
       await options.prepare?.(ctx)
     },
   )
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fd03c89885..ee7463110f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1411,9 +1411,6 @@ importers:
 
   packages/boot/app-boot:
     dependencies:
-      '@deepseek-ai/dsh-atomic-write':
-        specifier: workspace:^
-        version: link:../../util/atomic-write
       '@deepseek-ai/dsh-package-manifest':
         specifier: workspace:^
         version: link:../../util/package-manifest
@@ -4282,9 +4279,6 @@ importers:
       '@deepseek-ai/dsh-client-test-runtime':
         specifier: workspace:^
         version: link:../../test-support/client-runtime
-      '@deepseek-ai/dsh-client-ui-conversation':
-        specifier: workspace:^
-        version: link:../ui-conversation
       '@deepseek-ai/dsh-client-ui-layout':
         specifier: workspace:^
         version: link:../ui-layout
diff --git a/python/sdk-runtime/README.i18n.yaml b/python/sdk-runtime/README.i18n.yaml
index 70ecb5d18f..6db85a5ee9 100644
--- a/python/sdk-runtime/README.i18n.yaml
+++ b/python/sdk-runtime/README.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write python/sdk-runtime/README.md
-README.md: adb2fb71c3893d9360d7593826fdca609f770b6e
-README.zh.md: a4decd5040ada700e84b0f1b3bacba7bbec8a56f
+README.md: b2fb0b29c44db0e9e251ce0227e334e08a14e0f1
+README.zh.md: 0f13c0a60c7378cb897ccfa7b7082bb86d722a07
diff --git a/python/sdk-runtime/README.md b/python/sdk-runtime/README.md
index adb2fb71c3..b2fb0b29c4 100644
--- a/python/sdk-runtime/README.md
+++ b/python/sdk-runtime/README.md
@@ -27,7 +27,7 @@ Unsupported platforms and missing executables or sidecars raise `FileNotFoundErr
 
 ## Packaged profile resolution
 
-`dsh` initializes shipped profiles under the explicit home, composes their bundle patches, and loads bundled plugins from the executable's virtual filesystem. Because operating-system symlinks cannot enter that filesystem, packaged launches maintain small real ESM proxy packages under `$DSH_HOME/profiles/node_modules`. Each proxy mirrors explicit runtime exports, records the original package identity, and re-exports the virtual module URL. Built-in rows and external plugin peers therefore share one Cordis/module instance. Native shared libraries and Windows ConPTY addons are packaged with native addons, while ripgrep and the macOS PTY helper remain executable sidecars.
+`dsh` initializes shipped profiles under the explicit home, composes their bundle patches, and loads bundled plugins from the executable's virtual filesystem. Runtime resolution uses an in-memory generation instead of disk symlinks or proxy packages. Fallback imports use recorded declaring-package paths, including paths inside the executable's virtual filesystem, so built-in rows and external plugin peers share the bundled Cordis/module instance. Native shared libraries and Windows ConPTY addons are packaged with native addons, while ripgrep and the macOS PTY helper remain executable sidecars.
 
 The Python bootstrap resolves the Office kit from its adjacent directory so native helpers and URL Workers use real filesystem paths. The kit owns engine selection and validation; the Python bootstrap adds no runtime download or compilation.
 
diff --git a/python/sdk-runtime/README.zh.md b/python/sdk-runtime/README.zh.md
index a4decd5040..0f13c0a60c 100644
--- a/python/sdk-runtime/README.zh.md
+++ b/python/sdk-runtime/README.zh.md
@@ -27,7 +27,7 @@ wheel 包会安装 `dsh` 控制台命令和 `deepseek_harness_runtime` Python 
 
 ## 打包后的 profile 解析
 
-`dsh` 在显式指定的主目录下初始化随附 profile、组合其 bundle patch，并从可执行程序的虚拟文件系统加载内置插件。操作系统符号链接无法进入该文件系统，因此打包运行会在 `$DSH_HOME/profiles/node_modules` 下维护小型真实 ESM 代理包。每个代理复现运行时的显式导出项、记录原包身份，并重新导出虚拟模块 URL。因此，内置配置项与外部插件 peer 会共享同一个 Cordis／模块实例。原生共享库与 Windows ConPTY addon 会同其他原生 addon 一起打包；ripgrep 与 macOS PTY helper 仍是可执行伴随程序。
+`dsh` 在显式指定的主目录下初始化随附 profile、组合其 bundle patch，并从可执行程序的虚拟文件系统加载内置插件。运行时解析使用内存中的 generation，不创建磁盘符号链接或代理包。fallback 导入使用记录的声明包路径，包括可执行程序虚拟文件系统内的路径，因此内置配置项与外部插件 peer 共享内置的 Cordis／模块实例。原生共享库与 Windows ConPTY addon 会同其他原生 addon 一起打包；ripgrep 与 macOS PTY helper 仍是可执行伴随程序。
 
 Python bootstrap 从相邻目录解析 Office kit，让原生辅助程序与 URL Worker 使用真实文件系统路径。kit 负责引擎选择与校验；Python bootstrap 不增加运行时下载或编译。
 
diff --git a/scripts/run-gates.spec.ts b/scripts/run-gates.spec.ts
index 09be01c1dd..2f3083916c 100644
--- a/scripts/run-gates.spec.ts
+++ b/scripts/run-gates.spec.ts
@@ -752,11 +752,13 @@ describe('Node 24 lane ownership', () => {
     }
     expect(subject.find(item => item.id === 'snapshot')?.env).toEqual({ DSH_EXAMPLE_MODE: 'lib' })
     expect(subject.find(item => item.id === 'expected-output')?.env).toEqual({ DSH_EXAMPLE_MODE: 'lib' })
+    expect(subject.find(item => item.id === 'built-bin-smoke')?.env).toEqual({ DSH_EXAMPLE_MODE: 'lib' })
     expect(subject.find(item => item.id === 'doc-typecheck')?.env).toEqual({
       DSH_DOC_TYPECHECK_USE_BUILD_OUTPUT: '1',
     })
     expect(subject.find(item => item.id === 'built-bin-smoke')?.args).toEqual(
       expect.arrayContaining([
+        'apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts',
         'packages/subprocess/subprocess-local/tests/spawn-runner-built.e2e.ts',
         'packages/subagent/subagent-codex/tests/loader-composition.e2e.ts',
         'packages/subagent/subagent-claude-code/tests/loader-composition.e2e.ts',
diff --git a/scripts/run-gates.ts b/scripts/run-gates.ts
index 2b70a01a22..aa308e66fa 100644
--- a/scripts/run-gates.ts
+++ b/scripts/run-gates.ts
@@ -849,6 +849,7 @@ function builtBinSmokeGate(needs: string[] = ['build']): Gate {
     '--config',
     'vitest.e2e.config.ts',
     'apps/cli/tests/profiles/headless/tests/keyless-smoke.e2e.ts',
+    'apps/cli/tests/profiles/headless/tests/source-tool.built.e2e.ts',
     'apps/cli/tests/built-bin.e2e.ts',
     'packages/host/directory-picker-native/tests/built-worker.e2e.ts',
     'packages/sdk/server/tests/built-scope-carrier.e2e.ts',
diff --git a/scripts/verify-cordis-config.ts b/scripts/verify-cordis-config.ts
index 44200e131a..ffeb8f08f3 100644
--- a/scripts/verify-cordis-config.ts
+++ b/scripts/verify-cordis-config.ts
@@ -228,13 +228,13 @@ function validateAppResolution(): string[] {
   const violations: string[] = []
   const bundleManifests = bundleManifestPaths()
   // App overlays (and any config left under apps/cli/config) resolve from the
-  // dsh app's own dependency surface — the profile module fallback mirrors it.
+  // dsh app's own dependency surface — the runtime resolution mirrors it.
   const appManifest = readManifest('apps/cli/package.json')
   const appDependencies = {
     ...appManifest.dependencies,
-    // The fallback also links every in-box bundle's own dependencies
-    // (healProfilesModuleFallback). Optional Profile bundles stay outside the
-    // app installation until that Profile installs them.
+    // Runtime resolution includes every in-box bundle's own dependencies.
+    // Optional Profile bundles stay outside the app installation until that
+    // Profile installs them.
     ...Object.fromEntries(globSync('packages/bundle/*/package.json', { cwd: root })
       .flatMap(file => Object.entries(readManifest(file).dependencies ?? {}))),
   }
diff --git a/snapshots/web/auto-review-denial/ui.expected.md b/snapshots/web/auto-review-denial/ui.expected.md
index e2b23855a9..172a68cb4a 100644
--- a/snapshots/web/auto-review-denial/ui.expected.md
+++ b/snapshots/web/auto-review-denial/ui.expected.md
@@ -1,8 +1,7 @@
 ## Collapsed
 
 - banner:
-  - navigation "Session hierarchy":
-    - button "{{workspace}}" [disabled]
+  - navigation "Session hierarchy": {{workspace}}
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
@@ -27,8 +26,7 @@
 ## Expanded
 
 - banner:
-  - navigation "Session hierarchy":
-    - button "{{workspace}}" [disabled]
+  - navigation "Session hierarchy": {{workspace}}
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
@@ -57,8 +55,7 @@
 ## Trajectory
 
 - banner:
-  - navigation "Session hierarchy":
-    - button "{{workspace}}" [disabled]
+  - navigation "Session hierarchy": {{workspace}}
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/bash-abort-row/ui.expected.md b/snapshots/web/bash-abort-row/ui.expected.md
index 1a8add8380..d6188dfffa 100644
--- a/snapshots/web/bash-abort-row/ui.expected.md
+++ b/snapshots/web/bash-abort-row/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - 'button "Run two shell commands: wait" [disabled]'
+  - navigation "Session hierarchy": "Run two shell commands: wait"
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/deepseek-messages-chat/ui.expected.md b/snapshots/web/deepseek-messages-chat/ui.expected.md
index df658c2f8f..9a790ba8ea 100644
--- a/snapshots/web/deepseek-messages-chat/ui.expected.md
+++ b/snapshots/web/deepseek-messages-chat/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "会话层级":
-    - button "只回复 MESSAGES_WEB_READY，不调用" [disabled]
+  - navigation "会话层级": 只回复 MESSAGES_WEB_READY，不调用
   - text: 标准模式
   - button "更多操作"
   - button "打开右侧边栏"
diff --git a/snapshots/web/details-session-lifecycle/sidebar.expected.md b/snapshots/web/details-session-lifecycle/sidebar.expected.md
index 83ddf0bad8..2a8b1d5955 100644
--- a/snapshots/web/details-session-lifecycle/sidebar.expected.md
+++ b/snapshots/web/details-session-lifecycle/sidebar.expected.md
@@ -13,7 +13,7 @@
     644,
     756
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": true,
   "mode": "push",
   "panelContentWidth": 756,
@@ -157,7 +157,7 @@
     1400,
     0
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": false,
   "mode": "push",
   "panelContentWidth": 0,
@@ -242,7 +242,7 @@
     644,
     756
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": true,
   "mode": "push",
   "panelContentWidth": 756,
@@ -277,7 +277,7 @@
     644,
     756
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": true,
   "mode": "push",
   "panelContentWidth": 756,
@@ -325,7 +325,7 @@
     604,
     0
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": false,
   "mode": "push",
   "panelContentWidth": 0,
@@ -373,7 +373,7 @@
     1260,
     0
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": false,
   "mode": "push",
   "panelContentWidth": 0,
@@ -469,7 +469,7 @@
     1260,
     0
   ],
-  "columnTransition": "grid-template-columns",
+  "columnTransition": "all",
   "expanded": false,
   "mode": "push",
   "panelContentWidth": 0,
diff --git a/snapshots/web/feedback-command/ack-expanded.expected.md b/snapshots/web/feedback-command/ack-expanded.expected.md
index ba63fa0507..50bc047607 100644
--- a/snapshots/web/feedback-command/ack-expanded.expected.md
+++ b/snapshots/web/feedback-command/ack-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with the single word" [disabled]
+  - navigation "Session hierarchy": Reply with the single word
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/feedback-command/ack.expected.md b/snapshots/web/feedback-command/ack.expected.md
index c9e9bad335..d553156708 100644
--- a/snapshots/web/feedback-command/ack.expected.md
+++ b/snapshots/web/feedback-command/ack.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with the single word" [disabled]
+  - navigation "Session hierarchy": Reply with the single word
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/feedback-release/ack-expanded.expected.md b/snapshots/web/feedback-release/ack-expanded.expected.md
index ba63fa0507..50bc047607 100644
--- a/snapshots/web/feedback-release/ack-expanded.expected.md
+++ b/snapshots/web/feedback-release/ack-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with the single word" [disabled]
+  - navigation "Session hierarchy": Reply with the single word
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/feedback-release/ack.expected.md b/snapshots/web/feedback-release/ack.expected.md
index c9e9bad335..d553156708 100644
--- a/snapshots/web/feedback-release/ack.expected.md
+++ b/snapshots/web/feedback-release/ack.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with the single word" [disabled]
+  - navigation "Session hierarchy": Reply with the single word
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/file-upload-round/ui.expected.md b/snapshots/web/file-upload-round/ui.expected.md
index 373474e2e9..6435e7d5bf 100644
--- a/snapshots/web/file-upload-round/ui.expected.md
+++ b/snapshots/web/file-upload-round/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Read the attached file with" [disabled]
+  - navigation "Session hierarchy": Read the attached file with
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/fresh-round-trip/ui-expanded.expected.md b/snapshots/web/fresh-round-trip/ui-expanded.expected.md
index 2ec5da70af..0b593347b8 100644
--- a/snapshots/web/fresh-round-trip/ui-expanded.expected.md
+++ b/snapshots/web/fresh-round-trip/ui-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the bash tool to" [disabled]
+  - navigation "Session hierarchy": Use the bash tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/fresh-round-trip/ui.expected.md b/snapshots/web/fresh-round-trip/ui.expected.md
index 517580bf06..425343834b 100644
--- a/snapshots/web/fresh-round-trip/ui.expected.md
+++ b/snapshots/web/fresh-round-trip/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the bash tool to" [disabled]
+  - navigation "Session hierarchy": Use the bash tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/goal-multi-turn-actions/ui-expanded.expected.md b/snapshots/web/goal-multi-turn-actions/ui-expanded.expected.md
index 855ebe9a7d..ffd5ea6805 100644
--- a/snapshots/web/goal-multi-turn-actions/ui-expanded.expected.md
+++ b/snapshots/web/goal-multi-turn-actions/ui-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "workspace" [disabled]
+  - navigation "Session hierarchy": workspace
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/goal-multi-turn-actions/ui.expected.md b/snapshots/web/goal-multi-turn-actions/ui.expected.md
index de78d8224b..59dc395da6 100644
--- a/snapshots/web/goal-multi-turn-actions/ui.expected.md
+++ b/snapshots/web/goal-multi-turn-actions/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "workspace" [disabled]
+  - navigation "Session hierarchy": workspace
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/lifecycle-chrome/reloaded-expanded.expected.md b/snapshots/web/lifecycle-chrome/reloaded-expanded.expected.md
index cf4926f6df..8e1c4db5cc 100644
--- a/snapshots/web/lifecycle-chrome/reloaded-expanded.expected.md
+++ b/snapshots/web/lifecycle-chrome/reloaded-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with the single word" [disabled]
+  - navigation "Session hierarchy": Reply with the single word
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/lifecycle-chrome/reloaded.expected.md b/snapshots/web/lifecycle-chrome/reloaded.expected.md
index 1cef83a500..c4bf010378 100644
--- a/snapshots/web/lifecycle-chrome/reloaded.expected.md
+++ b/snapshots/web/lifecycle-chrome/reloaded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with the single word" [disabled]
+  - navigation "Session hierarchy": Reply with the single word
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/cancel-expanded.expected.md b/snapshots/web/live-interactions/cancel-expanded.expected.md
index fb713503be..1cbe13209e 100644
--- a/snapshots/web/live-interactions/cancel-expanded.expected.md
+++ b/snapshots/web/live-interactions/cancel-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/cancel.expected.md b/snapshots/web/live-interactions/cancel.expected.md
index fb25f9e5d1..b30b140798 100644
--- a/snapshots/web/live-interactions/cancel.expected.md
+++ b/snapshots/web/live-interactions/cancel.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/error-auth.expected.md b/snapshots/web/live-interactions/error-auth.expected.md
index 3f1ca8f061..aa423c09dc 100644
--- a/snapshots/web/live-interactions/error-auth.expected.md
+++ b/snapshots/web/live-interactions/error-auth.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/loading.expected.md b/snapshots/web/live-interactions/loading.expected.md
index af5082e65b..67b4bf71a4 100644
--- a/snapshots/web/live-interactions/loading.expected.md
+++ b/snapshots/web/live-interactions/loading.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/retry-exhausted.expected.md b/snapshots/web/live-interactions/retry-exhausted.expected.md
index 6eed77a7cf..0f9f0503c1 100644
--- a/snapshots/web/live-interactions/retry-exhausted.expected.md
+++ b/snapshots/web/live-interactions/retry-exhausted.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/retry-expanded.expected.md b/snapshots/web/live-interactions/retry-expanded.expected.md
index 1444cca162..d201eba408 100644
--- a/snapshots/web/live-interactions/retry-expanded.expected.md
+++ b/snapshots/web/live-interactions/retry-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/retry.expected.md b/snapshots/web/live-interactions/retry.expected.md
index e02699f7b7..435a2aac62 100644
--- a/snapshots/web/live-interactions/retry.expected.md
+++ b/snapshots/web/live-interactions/retry.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/live-interactions/running-draft.expected.md b/snapshots/web/live-interactions/running-draft.expected.md
index 7dcb2dc2f9..6518e42770 100644
--- a/snapshots/web/live-interactions/running-draft.expected.md
+++ b/snapshots/web/live-interactions/running-draft.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/message-actions/ui.expected.md b/snapshots/web/message-actions/ui.expected.md
index 4f94675057..df127b9b31 100644
--- a/snapshots/web/message-actions/ui.expected.md
+++ b/snapshots/web/message-actions/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the read tool twice" [disabled]
+  - navigation "Session hierarchy": Use the read tool twice
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/minimal-preset/ui.expected.md b/snapshots/web/minimal-preset/ui.expected.md
index 747da8bbea..3567494649 100644
--- a/snapshots/web/minimal-preset/ui.expected.md
+++ b/snapshots/web/minimal-preset/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the bash tool to" [disabled]
+  - navigation "Session hierarchy": Use the bash tool to
   - text: Minimal mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/open-in-app-ssh/header.expected.md b/snapshots/web/open-in-app-ssh/header.expected.md
index bdbf2c4c21..6d6e9882da 100644
--- a/snapshots/web/open-in-app-ssh/header.expected.md
+++ b/snapshots/web/open-in-app-ssh/header.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the read tool twice" [disabled]
+  - navigation "Session hierarchy": Use the read tool twice
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/plan-review/approved-expanded.expected.md b/snapshots/web/plan-review/approved-expanded.expected.md
index de1a76aed0..71a77be2f5 100644
--- a/snapshots/web/plan-review/approved-expanded.expected.md
+++ b/snapshots/web/plan-review/approved-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - 'button "Plan a small change: add" [disabled]'
+  - navigation "Session hierarchy": "Plan a small change: add"
   - text: Standard mode
   - button "More actions"
   - tablist:
diff --git a/snapshots/web/plan-review/approved.expected.md b/snapshots/web/plan-review/approved.expected.md
index 17cb2ec82d..94ba2c08b5 100644
--- a/snapshots/web/plan-review/approved.expected.md
+++ b/snapshots/web/plan-review/approved.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - 'button "Plan a small change: add" [disabled]'
+  - navigation "Session hierarchy": "Plan a small change: add"
   - text: Standard mode
   - button "More actions"
   - tablist:
diff --git a/snapshots/web/present/ui.expected.md b/snapshots/web/present/ui.expected.md
index 452a842352..ad3780520c 100644
--- a/snapshots/web/present/ui.expected.md
+++ b/snapshots/web/present/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use one run_code program to" [disabled]
+  - navigation "Session hierarchy": Use one run_code program to
   - text: PTC mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/ptc-round/ui.expected.md b/snapshots/web/ptc-round/ui.expected.md
index dbfe01ae06..c62860982b 100644
--- a/snapshots/web/ptc-round/ui.expected.md
+++ b/snapshots/web/ptc-round/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - 'button "Using ONE run_code program: run" [disabled]'
+  - navigation "Session hierarchy": "Using ONE run_code program: run"
   - text: PTC mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/question-composer/answered-expanded.expected.md b/snapshots/web/question-composer/answered-expanded.expected.md
index eeb050167f..1e5e5a39cb 100644
--- a/snapshots/web/question-composer/answered-expanded.expected.md
+++ b/snapshots/web/question-composer/answered-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/question-composer/answered.expected.md b/snapshots/web/question-composer/answered.expected.md
index 6e7738f321..dd494fb614 100644
--- a/snapshots/web/question-composer/answered.expected.md
+++ b/snapshots/web/question-composer/answered.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/question-composer/cancelled.expected.md b/snapshots/web/question-composer/cancelled.expected.md
index 532ff0ebf1..15af0b5cc7 100644
--- a/snapshots/web/question-composer/cancelled.expected.md
+++ b/snapshots/web/question-composer/cancelled.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/queue-actions/collapsed.expected.md b/snapshots/web/queue-actions/collapsed.expected.md
index 59a81e6864..765e045f17 100644
--- a/snapshots/web/queue-actions/collapsed.expected.md
+++ b/snapshots/web/queue-actions/collapsed.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queue-actions/editing.expected.md b/snapshots/web/queue-actions/editing.expected.md
index be9dfc391f..96eff6022d 100644
--- a/snapshots/web/queue-actions/editing.expected.md
+++ b/snapshots/web/queue-actions/editing.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queue-actions/layout.expected.md b/snapshots/web/queue-actions/layout.expected.md
index 8f72d4167e..0d5d2ce2b1 100644
--- a/snapshots/web/queue-actions/layout.expected.md
+++ b/snapshots/web/queue-actions/layout.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "workspace" [disabled]
+  - navigation "Session hierarchy": workspace
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queue-actions/preserved-expanded.expected.md b/snapshots/web/queue-actions/preserved-expanded.expected.md
index 68e79378fc..fe66236496 100644
--- a/snapshots/web/queue-actions/preserved-expanded.expected.md
+++ b/snapshots/web/queue-actions/preserved-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queue-actions/preserved.expected.md b/snapshots/web/queue-actions/preserved.expected.md
index 099622b124..66052f1522 100644
--- a/snapshots/web/queue-actions/preserved.expected.md
+++ b/snapshots/web/queue-actions/preserved.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queue-actions/sending.expected.md b/snapshots/web/queue-actions/sending.expected.md
index 54b3b9d7e3..07dd357aba 100644
--- a/snapshots/web/queue-actions/sending.expected.md
+++ b/snapshots/web/queue-actions/sending.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queue-actions/ui.expected.md b/snapshots/web/queue-actions/ui.expected.md
index 460fa0d74e..9e43a41140 100644
--- a/snapshots/web/queue-actions/ui.expected.md
+++ b/snapshots/web/queue-actions/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queued-image/delivered.expected.md b/snapshots/web/queued-image/delivered.expected.md
index 4e3aaa548f..289963776b 100644
--- a/snapshots/web/queued-image/delivered.expected.md
+++ b/snapshots/web/queued-image/delivered.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/queued-image/queued.expected.md b/snapshots/web/queued-image/queued.expected.md
index a95034a4c8..e28d8df980 100644
--- a/snapshots/web/queued-image/queued.expected.md
+++ b/snapshots/web/queued-image/queued.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Reply with a one-sentence description" [disabled]
+  - navigation "Session hierarchy": Reply with a one-sentence description
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/seeded-history/command-row.expected.md b/snapshots/web/seeded-history/command-row.expected.md
index 72449c0f85..727368f383 100644
--- a/snapshots/web/seeded-history/command-row.expected.md
+++ b/snapshots/web/seeded-history/command-row.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the read tool twice" [disabled]
+  - navigation "Session hierarchy": Use the read tool twice
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/seeded-history/feedback-row.expected.md b/snapshots/web/seeded-history/feedback-row.expected.md
index ca827139a0..2b26bde0d6 100644
--- a/snapshots/web/seeded-history/feedback-row.expected.md
+++ b/snapshots/web/seeded-history/feedback-row.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the read tool twice" [disabled]
+  - navigation "Session hierarchy": Use the read tool twice
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/seeded-history/ui-expanded.expected.md b/snapshots/web/seeded-history/ui-expanded.expected.md
index cedbc667dd..bd687552fd 100644
--- a/snapshots/web/seeded-history/ui-expanded.expected.md
+++ b/snapshots/web/seeded-history/ui-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the read tool twice" [disabled]
+  - navigation "Session hierarchy": Use the read tool twice
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/seeded-history/ui.expected.md b/snapshots/web/seeded-history/ui.expected.md
index 57b3f91a06..0a26ac4c88 100644
--- a/snapshots/web/seeded-history/ui.expected.md
+++ b/snapshots/web/seeded-history/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the read tool twice" [disabled]
+  - navigation "Session hierarchy": Use the read tool twice
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/skill-tool-row/ui.expected.md b/snapshots/web/skill-tool-row/ui.expected.md
index 7d49827d5a..aa014bd9e0 100644
--- a/snapshots/web/skill-tool-row/ui.expected.md
+++ b/snapshots/web/skill-tool-row/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Load the editing-cordis-compositions ski" [disabled]
+  - navigation "Session hierarchy": Load the editing-cordis-compositions ski
   - button "More actions"
   - button "Open right sidebar"
   - tablist:
diff --git a/snapshots/web/steering/mid-steer.expected.md b/snapshots/web/steering/mid-steer.expected.md
index 93fad593d4..18b8b2bda0 100644
--- a/snapshots/web/steering/mid-steer.expected.md
+++ b/snapshots/web/steering/mid-steer.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/steering/settled-expanded.expected.md b/snapshots/web/steering/settled-expanded.expected.md
index 6964c343be..558a2cbccd 100644
--- a/snapshots/web/steering/settled-expanded.expected.md
+++ b/snapshots/web/steering/settled-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/steering/settled.expected.md b/snapshots/web/steering/settled.expected.md
index 04ad8d224d..9d5e8bbdc5 100644
--- a/snapshots/web/steering/settled.expected.md
+++ b/snapshots/web/steering/settled.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use the ask_user_question tool to" [disabled]
+  - navigation "Session hierarchy": Use the ask_user_question tool to
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/turn-tail-actions/completed.expected.md b/snapshots/web/turn-tail-actions/completed.expected.md
index 7b3c3e481e..88cbf864a8 100644
--- a/snapshots/web/turn-tail-actions/completed.expected.md
+++ b/snapshots/web/turn-tail-actions/completed.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Begin your reply with the" [disabled]
+  - navigation "Session hierarchy": Begin your reply with the
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/turn-tail-actions/focused.expected.md b/snapshots/web/turn-tail-actions/focused.expected.md
index 3e0c193e31..97ce445aef 100644
--- a/snapshots/web/turn-tail-actions/focused.expected.md
+++ b/snapshots/web/turn-tail-actions/focused.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Begin your reply with the" [disabled]
+  - navigation "Session hierarchy": Begin your reply with the
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/turn-tail-actions/running.expected.md b/snapshots/web/turn-tail-actions/running.expected.md
index 7ec908b972..0aad69b556 100644
--- a/snapshots/web/turn-tail-actions/running.expected.md
+++ b/snapshots/web/turn-tail-actions/running.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Begin your reply with the" [disabled]
+  - navigation "Session hierarchy": Begin your reply with the
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/turn-tail-actions/settled.expected.md b/snapshots/web/turn-tail-actions/settled.expected.md
index c04c99e14e..33ff59bd2a 100644
--- a/snapshots/web/turn-tail-actions/settled.expected.md
+++ b/snapshots/web/turn-tail-actions/settled.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Begin your reply with the" [disabled]
+  - navigation "Session hierarchy": Begin your reply with the
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/turn-tail-actions/usage-expanded.expected.md b/snapshots/web/turn-tail-actions/usage-expanded.expected.md
index 64a4b1b0ef..ea6ffa712d 100644
--- a/snapshots/web/turn-tail-actions/usage-expanded.expected.md
+++ b/snapshots/web/turn-tail-actions/usage-expanded.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Begin your reply with the" [disabled]
+  - navigation "Session hierarchy": Begin your reply with the
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"
diff --git a/snapshots/web/web-search-round/ui.expected.md b/snapshots/web/web-search-round/ui.expected.md
index bc6f17f5f4..a843fffa55 100644
--- a/snapshots/web/web-search-round/ui.expected.md
+++ b/snapshots/web/web-search-round/ui.expected.md
@@ -1,6 +1,5 @@
 - banner:
-  - navigation "Session hierarchy":
-    - button "Use web_search once with queries" [disabled]
+  - navigation "Session hierarchy": Use web_search once with queries
   - text: Standard mode
   - button "More actions"
   - button "Open right sidebar"