verify-cordis-config now requires every configured specifier of a local
workspace package to resolve through the tsconfig.base.json paths facade
to a .ts/.tsx source file. A failed resolution or a .d.ts hit (the exports
fallback into built lib/types) fails the gate, so a missing paths mapping
is a red gate instead of a clean-tree-only startup crash masked by built
trees in CI. Removing the dsh-tui/prompt mapping reproduces the failure.
Agent Note records the decision and alternatives.
Merging master swapped the plain "▸ 上下文注入" button for the shared
DisclosureRow, which every conversation golden carrying an injected-context
row renders. The only change in all twelve files is that row.
The rename to deepseek-official reached cordis.snapshot.yml but not its
persistent-tools sibling, so the replay catalog no longer owned the route the
agent asks for. The SDK server then mounted the real adapter, which failed the
turn on a missing key. Re-records the six transcripts and the two diagnostics
cards that still carried the old route name.
The tui.cordis.yml entry for @deepseek-ai/dsh-tui/prompt had no tsconfig
paths mapping: the @deepseek-ai/dsh-* wildcard substitutes tui/prompt whole
into nonexistent candidates, so the tsx source launch fell back to package
exports and required built lib/prompt.js. pnpm dsh failed at startup on
every clean tree (fresh worktrees) with 'plugin(s) failed to load'.
The mutate seam's root-path ops, its non-array rejection, and the recursion
into an existing nested object were unexercised, as was the whole containment
side of the settings/document-updated fan-out and the before-snapshot repair
of a section a hand edit left non-object. The settings.mutate route had no
round trip at all: neither the client method nor the handler entry ran.
The per-file coverage gate caught three uncovered paths in the error handling
this round added: the page banner for a failed row removal, the editor card's
transport-rejection catch, and `store.fail` itself.
Two of them are one click each — Remove with a rejecting write, Apply with a
rejecting write — so they are covered through the UI rather than by calling
the helpers directly. The third was a duplicated `error instanceof Error ?
error.message : String(error)` in two files; it becomes one exported
`messageOf`, which removes the branch from both call sites and gives the
fallback arm a home a direct unit test can reach (the lint rule forbids
rejecting a promise with a non-Error, so a rejection cannot exercise it).
The master merge moved the TUI composition into `apps/cli/config/base.cordis.yml`
and I carried the `settings-local` / `credentials-local` rows across without
adding them to the resolver manifest. Bare specifiers in an app config resolve
through that manifest's dependencies, so the whole tree failed to boot:
dsh: plugin(s) failed to load: @deepseek-ai/dsh-settings-local,
@deepseek-ai/dsh-credentials-local
which took every TUI PTY smoke with it. `verify-cordis-config` did not catch
it, so the boot smoke was the first signal.
