Merge remote-tracking branch 'origin/master' into codex/provider-retry-policy

# Conflicts:
#	docs/architecture.i18n.yaml
#	docs/config-catalog.md
#	packages/support/llm-replay/README.md

scripts/demo-code-mode.mjs

@@ -7,7 +7,7 @@ import { spawn } from 'node:child_process'
 
 // Each UI's node invocation matches its base demo script plus the overlay config.
 const UIS = new Map([
-  ['tui', ['--import', 'tsx', 'packages/examples/tui-demo/src/bin.ts', 'examples/tui-agent/code-mode.cordis.yml']],
+  ['tui', ['--import', 'tsx', 'apps/cli/src/bin.ts', '--config', 'examples/tui-agent/code-mode.cordis.yml']],
   ['acp', ['--import', 'tsx', 'packages/examples/acp-demo/src/bin.ts', '--config', 'examples/acp-agent/code-mode.cordis.yml']],
 ])
 

scripts/doc-budgets.manifest.json

@@ -4,7 +4,7 @@
   "docs/architecture.md": 1800,
   "docs/cordis-primer.md": 600,
   "docs/defensive-patterns.md": 550,
-  "docs/testing.md": 1020,
+  "docs/testing.md": 1100,
   "examples/AGENTS.md": 310,
   "packages/AGENTS.md": 660,
   "packages/README.md": 790

scripts/gen-cordis-catalog.ts

@@ -128,8 +128,10 @@ export const LINK_MAP: Record<string, string> = {
   SessionEventResultFilter: 'session-query.md',
   SessionEventSearchDocument: 'session-query.md',
   SessionEventSearchHit: 'session-query.md',
+  SessionEventSearchPage: 'session-query.md',
   SessionEventSearchRequest: 'session-query.md',
   SessionEventTrace: 'session-query.md',
+  SessionEventTraceObservation: 'session-query.md',
   SessionEventTraceRequest: 'session-query.md',
   SessionEventWindow: 'session-query.md',
   SessionLineageTrace: 'session-query.md',
@@ -139,6 +141,8 @@ export const LINK_MAP: Record<string, string> = {
   SessionSearchHit: 'session-query.md',
   SessionSearchPage: 'session-query.md',
   SessionSearchRequest: 'session-query.md',
+  SessionTitleObservation: 'session-query.md',
+  SessionTitleObservationResult: 'session-query.md',
   SessionTitleProvider: 'session-title.md',
   SessionTitleSnapshot: 'session-title.md',
   SkillDefinition: 'skills.md',
@@ -208,8 +212,10 @@ const TYPE_LINK_EXEMPTIONS: Readonly<Record<string, string>> = {
   BashEnvVariableInfo: 'service-local metadata type is owned by packages/bash/tool-bash/src/index.ts',
   CompactAgentContext: 'compaction service input is owned by packages/compact/compact/src/index.ts',
   CreateAgentOptions: 'agent creation contract is owned by packages/core/agent/README.md',
+  Domain: 'domain interface is owned by packages/storage/storage-domain/README.md',
   DomainChanged: 'event-local snapshot is owned by packages/storage/storage-domain/src/events.ts',
   DomainFacility: 'domain form facility is owned by packages/storage/storage-domain/README.md',
+  DomainImpl: 'domain implementation contract is owned by packages/storage/storage-domain/README.md',
   DomainSpec: 'domain declaration contract is owned by packages/storage/storage-domain/README.md',
   StorageBackend: 'backend contract is owned by packages/storage/storage/src/backend.ts',
   StorageForms: 'merge-extensible form map is owned by packages/storage/storage/src/index.ts',

scripts/gen-doc-graphs.ts

@@ -141,16 +141,24 @@ const SERVICE_ROLES: ServiceRole[] = [
     title: 'Non-session storage hub',
     mode: 'seam',
     implementations: ['storage-json', 'storage-sqlite'],
-    consumers: ['storage-domain', 'workspace'],
+    consumers: ['storage-domain'],
     note: 'Backends register side by side under names; data forms (domain first) mount on the hub and translate typed operations into opaque KV-unit primitives.',
   },
+  {
+    key: 'storageDomain',
+    pkg: 'storage-domain',
+    title: 'Domain data facility',
+    mode: 'core',
+    consumers: ['workspace'],
+    note: 'Waits for every configured backend, then publishes the domain form as one lifecycle-bound service for typed durable state.',
+  },
   {
     key: 'workspace',
     pkg: 'workspace',
     title: 'Workspace entity registry',
     mode: 'core',
-    consumers: [],
-    note: 'Owns WorkspaceId-branded records over the domain form; sessionIds is the single source of ownership truth. RPC and GUI consumers arrive next phase.',
+    consumers: ['apiproxy'],
+    note: 'Owns WorkspaceId-branded records over the domain facility; stable sessionIds accounts drive Host RPC and GUI projections.',
   },
   {
     key: 'sessionQuery',
@@ -158,8 +166,8 @@ const SERVICE_ROLES: ServiceRole[] = [
     title: 'Session reads, traces, filters, and search',
     mode: 'seam',
     implementations: ['session-query-sqlite'],
-    consumers: ['session-reference'],
-    note: 'The interface supplies exact reads, filters, and traces; its concrete backend adds full-text reconciliation, ranking, snippets, and cursor generations on the same service.',
+    consumers: ['session-reference', 'tool-session-query'],
+    note: 'The interface supplies exact reads, filters, and traces; its concrete backend adds full-text reconciliation, ranking, snippets, and cursor generations, while the model consumer owns workspace authority and cursor-free rendering.',
   },
   {
     key: 'sessionReferences',

scripts/gen-tool-catalog.ts

@@ -11,6 +11,8 @@ import { basename, resolve } from 'node:path'
 import { Context } from 'cordis'
 import type { ToolSchema } from '@deepseek-ai/dsh-llm'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
+import SessionStore from '@deepseek-ai/dsh-session'
+import SessionQuerySqlite from '@deepseek-ai/dsh-session-query-sqlite'
 import GoalService from '@deepseek-ai/dsh-goal'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, { type Config as ToolsConfig } from '@deepseek-ai/dsh-tools'
@@ -39,6 +41,7 @@ import * as ToolGoal from '@deepseek-ai/dsh-tool-goal'
 import Lsp from '@deepseek-ai/dsh-lsp'
 import * as ToolLsp from '@deepseek-ai/dsh-tool-lsp'
 import * as ToolSkill from '@deepseek-ai/dsh-tool-skill'
+import * as ToolSessionQuery from '@deepseek-ai/dsh-tool-session-query'
 import * as ToolTasks from '@deepseek-ai/dsh-tool-tasks'
 import * as ToolTodo from '@deepseek-ai/dsh-tool-todo'
 import * as ToolSubagent from '@deepseek-ai/dsh-tool-subagent'
@@ -316,6 +319,20 @@ const TOOL_PACKAGES: ToolPackage[] = [
       await ctx.plugin(ToolSkill)
     },
   },
+  {
+    pkg: '@deepseek-ai/dsh-tool-session-query',
+    dir: 'tool-session-query',
+    source: 'packages/session-query/tool-session-query/src/index.ts',
+    requires: ['ctx.tools', 'ctx.systemPrompt', 'ctx.sessionQuery', 'a calling Agent for workspace authority'],
+    writes: ['tool/call', 'tool/result'],
+    async mount(ctx) {
+      await ctx.plugin(SessionStore)
+      await ctx.plugin(SessionQuerySqlite, { path: ':memory:' })
+      await ctx.plugin(ToolSessionQuery)
+    },
+    note:
+      'The five read-only tools hide provider cursors and authorize every result from the immutable calling agent session. The package is opt-in; compositions that need enforced deadlines or bounded inline output also mount the generic timeout or spill policies.',
+  },
   {
     pkg: '@deepseek-ai/dsh-tool-subagent',
     dir: 'tool-subagent',

scripts/type-equiv.manifest.json

@@ -419,6 +419,16 @@
       "symbol": "SessionSurfaceSnapshot",
       "source": "packages/session-query/session-query/src/types.ts"
     },
+    {
+      "doc": "docs/core-data-structures/session-query.md",
+      "symbol": "SessionTitleObservation",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
+    {
+      "doc": "docs/core-data-structures/session-query.md",
+      "symbol": "SessionTitleObservationResult",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
     {
       "doc": "docs/core-data-structures/session-query.md",
       "symbol": "SessionEventRecord",
@@ -459,6 +469,11 @@
       "symbol": "SessionEventTrace",
       "source": "packages/session-query/session-query/src/types.ts"
     },
+    {
+      "doc": "docs/core-data-structures/session-query.md",
+      "symbol": "SessionEventTraceObservation",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
     {
       "doc": "docs/core-data-structures/session-title.md",
       "symbol": "SessionTitleProviderId",
@@ -1219,6 +1234,11 @@
       "symbol": "SessionSearchPage",
       "source": "packages/session-query/session-query/src/types.ts"
     },
+    {
+      "doc": "docs/core-data-structures/session-query.md",
+      "symbol": "SessionEventSearchPage",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
     {
       "doc": "docs/core-data-structures/session-query.md",
       "symbol": "SessionEventSearchHit",
@@ -1562,6 +1582,16 @@
       "symbol": "SessionSurfaceSnapshot",
       "source": "packages/session-query/session-query/src/types.ts"
     },
+    {
+      "doc": "docs/core-data-structures/session-query.zh.md",
+      "symbol": "SessionTitleObservation",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
+    {
+      "doc": "docs/core-data-structures/session-query.zh.md",
+      "symbol": "SessionTitleObservationResult",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
     {
       "doc": "docs/core-data-structures/session-query.zh.md",
       "symbol": "SessionEventRecord",
@@ -1602,6 +1632,11 @@
       "symbol": "SessionSearchPage",
       "source": "packages/session-query/session-query/src/types.ts"
     },
+    {
+      "doc": "docs/core-data-structures/session-query.zh.md",
+      "symbol": "SessionEventSearchPage",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
     {
       "doc": "docs/core-data-structures/session-query.zh.md",
       "symbol": "SessionEventSearchHit",
@@ -1647,6 +1682,11 @@
       "symbol": "SessionEventTrace",
       "source": "packages/session-query/session-query/src/types.ts"
     },
+    {
+      "doc": "docs/core-data-structures/session-query.zh.md",
+      "symbol": "SessionEventTraceObservation",
+      "source": "packages/session-query/session-query/src/types.ts"
+    },
     {
       "doc": "docs/core-data-structures/tools.zh.md",
       "symbol": "ToolOutputDefinition",

scripts/verify-package-readme-model-experience.ts

@@ -57,6 +57,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/client/ui-conversation': { kind: 'none', reason: 'Browser-side UI plugin layer; registers no model surface.' },
   'packages/client/ui-question': { kind: 'indirect', reason: 'The package mounts dsh-tool-ask-user; that tool owns the model-visible schema and answer rendering.' },
   'packages/client/ui-trajectory': { kind: 'none', reason: 'Browser-side UI plugin layer; registers no model surface.' },
+  'packages/client/ui-workspace': { kind: 'none', reason: 'Browser-side UI plugin layer; registers no model surface.' },
   'packages/client/ui-theme': { kind: 'none', reason: 'Browser-side UI plugin layer; registers no model surface.' },
   'packages/client/i18n': { kind: 'none', reason: 'Browser-side UI plugin layer; registers no model surface.' },
   'packages/client/web': { kind: 'none', reason: 'Browser-side UI plugin layer; registers no model surface.' },
@@ -66,7 +67,6 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/fs/fs-sandbox': { kind: 'indirect', reason: 'The provider backend delegates model rendering to dsh-tool-fs.' },
   'packages/hooks/hook-protocol': { kind: 'indirect', reason: 'Only the hook bridge plugins render decoded hook output to a model.' },
   'packages/host/apiproxy': { kind: 'none', reason: 'The wire contract and fetch carriers move already-composed messages and register no model surface.' },
-  'packages/host/runtime': { kind: 'indirect', reason: 'The assembly mounts model-facing plugins and injects provider/model defaults into agents.' },
   'packages/host/webserver': { kind: 'none', reason: 'The HTTP carrier bridges browser and API handler and registers no model surface.' },
   'packages/llm/llm': { kind: 'none', reason: 'The adapter registry forwards already-assembled requests unchanged.' },
   'packages/llm/token-meter': { kind: 'indirect', reason: 'The measurement service leaves model-visible changes to its consumers.' },
@@ -90,6 +90,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/support/agent-loop-testkit': { kind: 'none', reason: 'The test helper mounts services but neither drives nor modifies model requests.' },
   'packages/support/invariants': { kind: 'none', reason: 'The observer validates requests but never rewrites their context.' },
   'packages/support/loader-smoke': { kind: 'none', reason: 'The test harness observes child-process streams without changing live requests.' },
+  'packages/support/llm-mock-server': { kind: 'none', reason: 'The test server substitutes provider wire behavior without invoking a real model.' },
   'packages/support/llm-replay': { kind: 'none', reason: 'The keyless adapter invokes no provider model.' },
   'packages/tasks/tasks': { kind: 'indirect', reason: 'Producer and control-surface plugins own all model rendering over the task registry.' },
   'packages/examples/acp-demo': { kind: 'indirect', reason: 'The app bundle delegates request composition to dsh-agent-spine-demo and dsh-acp.' },