Merge remote-tracking branch 'origin/master' into mergebot/pr1008

# Conflicts:
#	examples/web-cordis/cordis.yml
#	packages/client/ui-conversation/src/client/apply.ts
#	packages/client/ui-conversation/src/client/chat/ChatView.tsx
#	packages/client/ui-conversation/src/client/chat/MessageItem.tsx
#	packages/client/ui-conversation/src/client/chat/ToolRow.module.css
#	packages/client/ui-conversation/src/client/chat/ToolRow.tsx
#	packages/client/ui-conversation/src/client/contract/slots.ts
#	packages/client/ui-conversation/tests/chat-branch-tails.spec.tsx
#	packages/client/ui-conversation/tests/chat-view.spec.tsx

examples/web-cordis/cordis.yml

@@ -1,21 +1,22 @@
 # Opt-in Web composition for inspecting the self-referential Cordis tools.
 # Temporary Plugin code can reach every injected live capability; treat this
 # deployment like shell access, not as a security boundary.
-- id: base
-  name: '@cordisjs/plugin-include'
+# This file is an OVERLAY over the shipped web composition (`base.cordis.yml` +
+# `web.cordis.yml`), not a tree: `dsh web --config` applies it as one more
+# sibling patch list at the same include level, so these patches reach base and
+# overlay rows alike. A patch replaces the targeted row's whole `config`.
+
+# AppCLIEntry normally injects the assembly-owned dist path before `dsh web`
+# boots; pinning the port here keeps this demo off the default 3080.
+- id: webserver
   config:
-    path: ../../apps/cli/cordis.yml
-    patches:
-      # AppCLIEntry normally injects this assembly-owned path before `dsh web`
-      # boots; the standalone Cordis launcher needs the equivalent patch here.
-      - id: webserver
-        config:
-          host: 127.0.0.1
-          port: 3081
-          # Plain concatenation, not URL.pathname: a cwd with spaces
-          # percent-encodes through the URL round-trip and the encoded
-          # path never resolves.
-          distIndex: !!js "process.cwd() + '/apps/web/dist/index.html'"
-      - insert:
-          - id: tool-cordis
-            name: '@deepseek-ai/dsh-tool-cordis'
+    host: 127.0.0.1
+    port: 3081
+    # Plain concatenation, not URL.pathname: a cwd with spaces
+    # percent-encodes through the URL round-trip and the encoded
+    # path never resolves.
+    distIndex: !!js "process.cwd() + '/apps/web/dist/index.html'"
+
+- insert:
+    - id: tool-cordis
+      name: '@deepseek-ai/dsh-tool-cordis'