Remove the `{ preset, insert }` / `{ preset, id, ...override }` profile patch
operation added in #5773, together with the app-boot compiler and reload drain,
config-editor filtering, plugin-manager preset row inventory and retained-module
removal checks, the read-only preset rows on the Plugins page, and the
agent-preset-registry row identities that served them.
Session search, Ralph, persistent terminals, Codex, and Claude Code bundles now
insert ordinary Host rows whose tools register in the global tool layer, like the
earlier optional bundles. Every preset, including minimal, sees them, and toggling
a bundle updates live Agents without new composition generations.
The packed rehearsal now names each stage on the child's stdout and bounds the
manager's removal, so an operation that never settles reports the profile lock
and the still-live pnpm process instead of only a test timeout. That evidence
located pnpm 11.7.0 leaving its worker pool alive after a short-circuit return
(pnpm issue 12297, fixed in 11.23.0 and carried by this stack's base).
Three attempts to keep pnpm off that path — a private pnpm store, installing
both bundles before removing either, and pre-declaring the profile's age
exemptions — did not change the outcome, so none of them remain.
- The summary lists only the catalog roots as installable specs; the other 29
archives stay in the run manifest, where the installer resolves them itself.
- Only a pnpm entrypoint receives pnpm's arguments, a catalog root counts as a
required edge for platform admission, and a signal that stops packing reports
the interrupted exit instead of an exception.
- The packed rehearsal names the Agent SDK's musl artifact on musl hosts again,
and its comments match what the fixture does.
- The cache test registers its pnpm children for termination, and a new case
keeps one profile and its real lockfile: pnpm refuses a new run's URL with
ERR_PNPM_TARBALL_URL_MISMATCH until the stale resolution is cleared with
pnpm's own `pnpm clean --lockfile` remedy, which the desktop README now
documents for same-version iteration.
The teardown asserted the Web process's SIGTERM exit inside `finally`, so a
body failure was reported as a shutdown timeout instead of itself. The
assertions now run only when the body passed, the earlier failure is rethrown
after teardown, and the listener readiness became a named step that no longer
clones the release pack coordinator's listen idiom.
A packaged application installs an Official on-demand bundle as
`name@<running DSH version>`, and the plugin manager asks a custom registry
alone, so the unsigned test DMG cannot install a locally built provider before
its release reaches npm: each packed manifest still names the rest of the
repository by version, and ordinary bundle tarballs therefore resolve against
a registry that does not have them yet.
`pnpm run dev:bundle-registry` validates the Official catalog and the workspace
inventory, builds the official artifacts, packs the catalog's complete local
dependency closure with the release families' own payload and manifest checks,
records the run in `dist/test-bundles/<run-id>/bundle-registry.json` as its
completion marker, and only then serves it from 127.0.0.1 on an allocated port
under a fresh namespace. Repository-owned names are answered from this run or
refused locally; third-party packages keep npm's real metadata and bytes
through a fixed redirect. The run publishes nothing, changes no global
npm/pnpm configuration, and leaves DMG packaging untouched.
The packed installer rehearsal now installs that closure into an isolated
profile with no `file:` override, checkout link, ignore list, or scoped
registry standing in for a package the registry should answer, and it asserts a
transitive repository package served only by this run.
Dudu-0223