fix(bundle): drop fs-local from the Windows layer — duplicate ctx.fs registration failed load

The Windows platform layer re-enables the base fs-sandbox row (removing its disable), but still inserted dsh-fs-local: both extend FileSystem and provide ctx.fs, so every shipped win32 profile failed at load. Delete the insert; fs-sandbox stays the single fs provider exactly as on POSIX. Sync the roster specs, the base/reference README pairs, the sandbox core doc (read-only grants no sink on Windows), the windows-shell JSDoc, and re-record the i18n pairings.

apps/cli/reference/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/reference/README.md
-README.md: 07b162517b90215a6552810124f15c435144f7d4
-README.zh.md: 80030707474e59e76583ed7edc5ddce56334cc03
+README.md: 8264e2e9f57a6687a1cddae15012324790b555ad
+README.zh.md: 84bd37e43a982a307a2df8045f7f3703e5b9a8b4

apps/cli/reference/README.md

@@ -51,7 +51,7 @@ Process shutdown gives the plugin tree up to five seconds to dispose. The first
 
 All modes treat the invoking directory as the default workspace root, load applicable `AGENTS.md` or `CLAUDE.md` instructions with a 65,536-byte render budget, and use an in-memory SQLite session content index. Long-lived surfaces watch valid edits of both `cordis.patch.yml` layers (profile and home) and reapply them transactionally; one-shot runs read the files once at startup.
 
-New sessions default to the `workspace-write` permission preset. Bash and filesystem mutations are restricted to the session workspace and platform temporary roots; reads, network access, and process visibility are not confined. `DSH_PERMISSION_MODE` changes the process fallback. Stored General-settings permissions affect later Web sessions, not an already-open one. On win32 hosts booting a shipped profile, the Windows platform layer removes the permission, sandbox, and approval rows entirely: the pwsh shell and the fs tools run unconfined with no workspace boundary (Windows has no OS sandbox runner — landlock/bwrap/seatbelt are POSIX-only — so the shipped posture is honest danger-full-access rather than a boundary the shell could bypass), and `DSH_PERMISSION_MODE` and stored permission settings have no effect there.
+New sessions default to the `workspace-write` permission preset. Bash and filesystem mutations are restricted to the session workspace and platform temporary roots; reads, network access, and process visibility are not confined. `DSH_PERMISSION_MODE` changes the process fallback. Stored General-settings permissions affect later Web sessions, not an already-open one. On win32 hosts booting a shipped profile, the same permission surface runs over the Windows ACL restricted-token runner: the pwsh executor and the fs tools enforce the workspace boundary through `@deepseek-ai/dsh-sandbox-windows-acl` exactly as on POSIX (the Windows `workspace-write` grant is the workspace plus the real temp directory; `read-only` grants nothing).
 
 `DSH_TOOLS_MODE` selects `native`, `code`, or `both` for the process; another value fails at boot. [`config/core-web.cordis.yml`](../config/core-web.cordis.yml) is an optional RL-compatible `--patch` overlay that pins native mode, renders only `DSH_SYSTEM_PROMPT` or `You are a helpful software engineer assistant.` as the system prompt, disables Workspace instructions and every Web runtime prompt contribution, and exposes only persistent `bash` and `str_replace_editor` while retaining the shipped host, browser, workspace, persistence, and permission composition.
 

apps/cli/reference/README.zh.md

@@ -51,7 +51,7 @@ dsh web --dump-config
 
 所有模式都将调用目录作为默认 workspace 根目录，以 65,536 字节渲染预算加载适用的 `AGENTS.md` 或 `CLAUDE.md` 指令，并使用内存 SQLite 会话内容索引。常驻 surface 监视两个 `cordis.patch.yml` 层（profile 与 home）的有效编辑并以事务方式重新应用；一次性运行只在启动时读取这些文件一次。
 
-新会话默认使用 `workspace-write` 权限预设。Bash 和文件系统修改仅限于会话 workspace 与平台临时根目录；读取、网络访问和进程可见性不受限制。`DSH_PERMISSION_MODE` 更改进程后备值。General settings 中存储的权限影响后续 Web 会话，不改变已打开的会话。在 win32 主机启动交付 profile 时，Windows 平台层会整体移除 permission、sandbox 与 approval 行：pwsh shell 与 fs 工具不受限运行，不存在 workspace 边界（Windows 上没有 OS 级 sandbox runner——landlock/bwrap/seatbelt 均为 POSIX 专属——因此交付姿态是诚实的 danger-full-access，而不是一个 shell 可以绕过的边界），`DSH_PERMISSION_MODE` 与存储的权限设置在彼处也不生效。
+新会话默认使用 `workspace-write` 权限预设。Bash 和文件系统修改仅限于会话 workspace 与平台临时根目录；读取、网络访问和进程可见性不受限制。`DSH_PERMISSION_MODE` 更改进程后备值。General settings 中存储的权限影响后续 Web 会话，不改变已打开的会话。在 win32 主机启动交付 profile 时，同一权限面运行在 Windows ACL 受限令牌 runner 之上：pwsh 执行器与 fs 工具通过 `@deepseek-ai/dsh-sandbox-windows-acl` 执行与 POSIX 完全一致的 workspace 边界（Windows 的 `workspace-write` 授权是工作区加真实 temp 目录；`read-only` 不授予任何写入）。
 
 `DSH_TOOLS_MODE` 为进程选择 `native`、`code` 或 `both`；其他值会导致启动失败。[`config/core-web.cordis.yml`](../config/core-web.cordis.yml) 是可选的 RL 兼容 `--patch` overlay：它固定使用 `native` 模式，仅将 `DSH_SYSTEM_PROMPT` 或 `You are a helpful software engineer assistant.` 渲染为系统提示词，禁用 Workspace 指令与所有 Web 运行时提示词贡献，并且在保留随附宿主、浏览器、workspace、持久化和权限组合的同时，仅暴露持久 `bash` 和 `str_replace_editor`。
 

apps/cli/src/windows-shell.ts

@@ -1,8 +1,8 @@
 /**
  * The Windows shell platform layer: on win32 hosts the shipped profile
- * compositions swap the POSIX-only bash stack for the PowerShell stack
- * (`@deepseek-ai/dsh-pwsh-local` + `@deepseek-ai/dsh-tool-pwsh`), matching
- * the Windows-pwsh-default roadmap. The layer is the base bundle's
+ * compositions swap the POSIX-only bash stack for the sandbox-confined
+ * PowerShell stack (`@deepseek-ai/dsh-pwsh-sandbox` +
+ * `@deepseek-ai/dsh-tool-pwsh`), matching the Windows-pwsh-default roadmap. The layer is the base bundle's
  * `windows.cordis.patch.yml`, injected by the launcher between the bundle
  * layers and the user layers so a user patch can still override it — the
  * only override channel is composition config, like every other roster

apps/cli/tests/windows-shell.spec.ts

@@ -14,8 +14,8 @@ import {
 const WINDOWS_PATCH = `- id: bash-sandbox
   disabled: true
 - insert:
-    - id: pwsh-local
-      name: '@deepseek-ai/dsh-pwsh-local'
+    - id: pwsh-sandbox
+      name: '@deepseek-ai/dsh-pwsh-sandbox'
 `
 
 /** One fake bundle layer rooted in a temp directory. */
@@ -48,7 +48,7 @@ describe('resolveWindowsShellLayer', () => {
     expect(layer?.label.endsWith(WINDOWS_SHELL_PATCH_FILENAME)).toBe(true)
     expect(layer?.patches).toEqual([
       { id: 'bash-sandbox', disabled: true },
-      { insert: [{ id: 'pwsh-local', name: '@deepseek-ai/dsh-pwsh-local' }] },
+      { insert: [{ id: 'pwsh-sandbox', name: '@deepseek-ai/dsh-pwsh-sandbox' }] },
     ])
   })
 
@@ -73,7 +73,7 @@ describe('the shipped Windows composition (real bundle layers)', () => {
   // suite composes the shipped patch files, not test fixtures.
   const anchor = fileURLToPath(new URL('../package.json', import.meta.url))
 
-  it('composes the win32 danger-full-access roster through the real patch layers', () => {
+  it('composes the win32 confined roster through the real patch layers', () => {
     home = mkdtempSync(join(tmpdir(), 'dsh-windows-home-'))
     initProfile(join(home, PROFILES_DIR, 'web'), ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
     const profile = loadProfile('dsh', 'web', anchor, home)
@@ -85,19 +85,24 @@ describe('the shipped Windows composition (real bundle layers)', () => {
       message => warnings.push(message),
     )
     const byId = new Map(rows.map(row => [row.id, row]))
-    for (const id of ['bash-sandbox', 'tool-bash', 'permission', 'ui-permission',
-      'sandbox', 'sandbox-policy', 'fs-sandbox', 'approval']) {
+    // Only the POSIX bash stack leaves the roster: the permission surface
+    // (sandbox/sandbox-policy/fs-sandbox, permission, approval) stays enabled
+    // exactly as on POSIX — the confined pwsh executor is what changes.
+    for (const id of ['bash-sandbox', 'tool-bash']) {
       expect(byId.get(id)?.disabled, `row ${id}`).toBe(true)
     }
-    for (const id of ['pwsh-local', 'tool-pwsh', 'fs-local']) {
+    for (const id of ['permission', 'ui-permission', 'sandbox', 'sandbox-policy', 'fs-sandbox', 'approval']) {
+      expect(byId.get(id)?.disabled, `row ${id}`).not.toBe(true)
+    }
+    for (const id of ['pwsh-sandbox', 'tool-pwsh']) {
       expect(byId.has(id), `inserted row ${id}`).toBe(true)
     }
-    // The web-app layer provides ui-permission, so the full web profile
-    // composes without any no-match warning.
+    // The patch touches only base-owned rows plus inserts, so the full web
+    // profile composes without any no-match warning.
     expect(warnings).toEqual([])
   })
 
-  it('leaves POSIX untouched and base-only profiles warned but harmless', () => {
+  it('leaves POSIX untouched and base-only profiles compose without warnings', () => {
     home = mkdtempSync(join(tmpdir(), 'dsh-windows-home-'))
     initProfile(join(home, PROFILES_DIR, 'web'), ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'])
     const profile = loadProfile('dsh', 'web', anchor, home)
@@ -106,10 +111,11 @@ describe('the shipped Windows composition (real bundle layers)', () => {
     const posixById = new Map(posixRows.map(row => [row.id, row]))
     expect(posixById.get('bash-sandbox')?.disabled).not.toBe(true)
     expect(posixById.has('pwsh-local')).toBe(false)
+    expect(posixById.has('pwsh-sandbox')).toBe(false)
 
-    // A base-only custom profile (the DEFAULT_PROFILE_BUNDLES template):
-    // ui-permission has no row to patch, so the shipped layer warns once per
-    // composition — never fails — exactly as its header comment documents.
+    // A base-only custom profile (the DEFAULT_PROFILE_BUNDLES template): the
+    // patch touches only base-owned rows (bash-sandbox/tool-bash) plus its
+    // inserts, so the composition produces no no-match warning.
     initProfile(join(home, PROFILES_DIR, 'base-only'), ['@deepseek-ai/dsh-base'])
     const baseOnly = loadProfile('dsh', 'base-only', anchor, home)
     const baseWarnings: string[] = []
@@ -119,6 +125,6 @@ describe('the shipped Windows composition (real bundle layers)', () => {
       [...baseOnly.layers.map(layer => layer.patches), win32!.patches],
       message => baseWarnings.push(message),
     )
-    expect(baseWarnings.some(message => message.includes('ui-permission'))).toBe(true)
+    expect(baseWarnings).toEqual([])
   })
 })