omdsh-dev · mattheliu · Sep 28, 2026 · Sep 28, 2026 · Sep 28, 2026
@@ -28,6 +28,7 @@ jobs:
           node-version: ${{ matrix.node }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm run check:peers
       - if: matrix.os == 'ubuntu-latest' && matrix.node == '24.x'
         run: pnpm run evidence:validate
       - run: pnpm run typecheck
@@ -46,7 +47,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: omdsh-dev/deepseek-harness
-          ref: dsh-v0.1.7-alpha.1-a11y.4
+          ref: 1e53eedb532a7965aee4d4c294c2ee313cf15906
           path: .assembled/dsh
       - uses: pnpm/action-setup@v6
         with:

@@ -10,7 +10,7 @@ Tracking: [alpha.2 core migration #22](https://github.com/omdsh-dev/dsh-accessib
 
 ## Purpose and evidence boundary
 
-This lab launches the exact DSH `0.1.7-alpha.1` core candidate with two copies of DSH's committed synthetic seeded-history Session. It uses a disposable DSH home, persistence root, and workspace, and needs no API key or companion plugin. It covers the core shell, Workspace tree, Session views, Chat history, Trajectory, Settings dialog, menus, disclosures, and adjustable separators.
+This lab launches the exact DSH `0.1.7-rc.2` core candidate with two copies of DSH's committed synthetic seeded-history Session. It uses a disposable DSH home, persistence root, and workspace, and needs no API key or companion plugin. It covers the core shell, Workspace tree, Session views, Chat history, Trajectory, Settings dialog, menus, disclosures, and adjustable separators.
 
 Lab readiness, an accessibility-tree dump, or a visible screen-reader caption is not an assistive-technology pass. A valid result needs a person to observe actual speech or braille, focus or cursor behavior, independent task completion, errors, and workarounds. Disabled-user evidence additionally requires informed consent and a de-identified task record. This static fixture does not test live response, tool, approval, question, or plan-review announcements; use the separate [live-announcement lab](AT-LIVE-LAB.md) for those evidence rows.
 
@@ -23,12 +23,12 @@ git clone https://github.com/omdsh-dev/deepseek-harness.git
 git clone https://github.com/omdsh-dev/dsh-accessibility.git
 
 cd deepseek-harness
-git checkout feat/a11y-core-0.1.7-alpha.1
-pnpm install
+git checkout feat/a11y-core-0.1.7-rc.2
+pnpm install --frozen-lockfile
 pnpm run build
 
 cd ../dsh-accessibility
-git checkout feat/compat-0.1.7-alpha.1
+git checkout feat/compat-0.1.7-rc.2
 pnpm install --frozen-lockfile
 ```
 

@@ -10,7 +10,7 @@
 
 ## 目的与证据边界
 
-本实验室用 DSH 自带的合成 seeded-history Session 启动精确的 DSH `0.1.7-alpha.1` 核心候选，并放入两份 Session 以便验证树导航。它使用一次性的 DSH home、持久化根目录和工作区，不需要 API key 或 companion 插件。覆盖范围包括应用外壳、Workspace 树、Session 视图、Chat 历史、Trajectory、Settings 对话框、菜单、展开控件和可调分隔条。
+本实验室用 DSH 自带的合成 seeded-history Session 启动精确的 DSH `0.1.7-rc.2` 核心候选，并放入两份 Session 以便验证树导航。它使用一次性的 DSH home、持久化根目录和工作区，不需要 API key 或 companion 插件。覆盖范围包括应用外壳、Workspace 树、Session 视图、Chat 历史、Trajectory、Settings 对话框、菜单、展开控件和可调分隔条。
 
 实验室成功就绪、无障碍树转储或可见的读屏字幕都不算辅助技术通过。有效结果必须由人实际观察语音或盲文、焦点或光标行为、独立任务完成、错误和变通方式。残障用户证据还需要知情同意和去标识化任务记录。本实验室使用静态 fixture，不验证实时回答、工具、审批、问题或计划评审播报；这些证据行使用独立的[实时播报实验室](AT-LIVE-LAB.zh.md)验证。
 
@@ -23,12 +23,12 @@ git clone https://github.com/omdsh-dev/deepseek-harness.git
 git clone https://github.com/omdsh-dev/dsh-accessibility.git
 
 cd deepseek-harness
-git checkout feat/a11y-core-0.1.7-alpha.1
-pnpm install
+git checkout feat/a11y-core-0.1.7-rc.2
+pnpm install --frozen-lockfile
 pnpm run build
 
 cd ../dsh-accessibility
-git checkout feat/compat-0.1.7-alpha.1
+git checkout feat/compat-0.1.7-rc.2
 pnpm install --frozen-lockfile
 ```
 

@@ -10,7 +10,7 @@ Tracking: [alpha.2 core migration #22](https://github.com/omdsh-dev/dsh-accessib
 
 ## Purpose and evidence boundary
 
-This lab gives a human tester six deterministic, keyless DSH `0.1.7-alpha.1` replay scenarios: completed response, stopped response, failed response, question, plan review, and tool approval. Each run creates one disposable DSH home, Workspace, and blank Session and prints the exact synthetic input. Chrome mode also creates a disposable browser profile; system and Safari modes do not guarantee browser-profile isolation.
+This lab gives a human tester six deterministic, keyless DSH `0.1.7-rc.2` replay scenarios: completed response, stopped response, failed response, question, plan review, and tool approval. Each run creates one disposable DSH home, Workspace, and blank Session and prints the exact synthetic input. Chrome mode also creates a disposable browser profile; system and Safari modes do not guarantee browser-profile isolation.
 
 The lab exists to observe real speech or braille and focus behavior from DSH's polite live region. A Host `turn/end` line proves only the durable product boundary; it does not prove that a screen reader announced it, announced it once, used understandable wording, or left the tester able to continue. Lab readiness, DOM text, an accessibility-tree dump, and visible captions are not AT passes. Disabled-user evidence additionally requires informed consent and a de-identified task record.
 

@@ -10,7 +10,7 @@
 
 ## 目的与证据边界
 
-本实验室为人工测试者提供六个确定、无密钥的 DSH `0.1.7-alpha.1` replay 场景：回答完成、回答停止、回答失败、问题、计划评审和工具审批。每次运行都会创建一次性 DSH home、Workspace 与空白 Session，并打印精确合成输入。Chrome 模式还会创建一次性浏览器 profile；system 与 Safari 模式不保证浏览器 profile 隔离。
+本实验室为人工测试者提供六个确定、无密钥的 DSH `0.1.7-rc.2` replay 场景：回答完成、回答停止、回答失败、问题、计划评审和工具审批。每次运行都会创建一次性 DSH home、Workspace 与空白 Session，并打印精确合成输入。Chrome 模式还会创建一次性浏览器 profile；system 与 Safari 模式不保证浏览器 profile 隔离。
 
 实验室用于观察 DSH polite live region 在真实语音或盲文中的表现，以及播报前后的焦点行为。Host `turn/end` 行只能证明产品持久终态，不能证明读屏已经播报、只播报一次、措辞可理解或测试者仍能继续任务。实验室就绪、DOM 文本、无障碍树转储和可见字幕都不算 AT 通过。残障用户证据还需要知情同意和去标识化任务记录。
 

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Prepare the unpublished `0.1.2-rc.1` companion candidate for exact DSH `0.1.7-rc.2`; keep the `0.2.0-rc.1` preview investigation separate from supported peer dependencies and preserve historical evidence at its original revisions.
+- Align the development runtime with Cordis `4.0.4` and `cordis-plugin-group` `1.0.4`, and require the peer-dependency check in CI alongside the exact DSH lockfile regression.
+- Record the migration's local checks without claiming migrated-core browser or real assistive-technology validation before those checks are complete.
+
 ## 0.1.0-beta.8 - 2026-09-07
 
 - Advance the exact accessibility-core baseline to `dsh-v0.1.2-rc.1-a11y.5` after refreshing the semantic queue snapshots and making the queued-action dock assertion portable across classic-scrollbar runners.

@@ -0,0 +1,55 @@
+# DSH 0.1.7-rc.2 compatibility
+
+English | [简体中文](COMPATIBILITY-0.1.7-rc.2.zh.md)
+
+Status: local migration checks complete; unpublished and awaiting review/CI. Real VoiceOver/NVDA and disabled-developer validation remain pending.
+
+## Exact targets
+
+The official npm registry reports `latest=0.1.7-rc.2` and `next=0.2.0-rc.1`, rechecked on 2026-09-29 (Asia/Shanghai). This branch targets `0.1.7-rc.2`; the preview requires a separate result and is not covered by this branch's exact peer dependencies.
+
+- Primary upstream: `dsh-v0.1.7-rc.2`, commit `477b4f420553e8a52c2fbccc464d7561b239c443`.
+- Separate preview: `dsh-v0.2.0-rc.1`, commit `4878cdabd87d4041bdaff61d04c966883b9fd07a`.
+- Companion candidate: `0.1.2-rc.1`, with exact DSH `0.1.7-rc.2` dependencies.
+
+The [alpha.1 record](COMPATIBILITY-0.1.7-alpha.1.md), existing tags, automated reports, and human campaign remain bound to their original revisions. Passing historical results are not evidence for this migration.
+
+## Local migration checks
+
+On 2026-09-28, the unpublished working tree passed these checks against the official npm `0.1.7-rc.2` packages:
+
+- Exact DSH dependency graph and one Cordis runtime (`4.0.4`); the companion peer range is `~4.0.4`, matching the upstream client packages. The development graph explicitly supplies `cordis-plugin-group@1.0.4` for the upstream boot package. `pnpm run check:peers` reports no peer dependency issues, and CI runs this check.
+- Host/client type checks and all 236 tests in 28 files.
+- Build and npm package dry run; the candidate contained 128 files. A pattern scan of those files found no credential-shaped strings, private-key headers, or local user-directory paths. This is not a comprehensive security audit.
+- Local tarball installation through the real DSH CLI into a disposable `DSH_HOME`, followed by a boot-free Web profile configuration dump. The companion was composed successfully with no version exemptions. No model request or user-profile migration was performed by this isolated smoke test.
+- Evidence schema validation. The real human-evidence ledger remains empty.
+
+Vite reported missing source maps in upstream npm packages during unit tests; the tests themselves passed. The package checks alone do not establish migrated-core or assembled compatibility; the separate checks below cover that integration.
+
+## Core integration checks
+
+The core merge is committed as `1e53eedb532a7965aee4d4c294c2ee313cf15906`, based on the exact upstream rc.2 commit above. The following local checks covered that implementation:
+
+- Build, all 18 hygiene gates, all 20 quick documentation gates, and all 42 full documentation synchronization gates passed. The final full lint found only one overlong function declaration; a formatting-only wrap and the owning-file lint cleared it.
+- The core accessibility browser lane passed 40 checks across Chromium, Firefox, and WebKit. Two forced-colors checks were explicitly skipped outside Chromium; these are automated browser checks, not assistive-technology observations.
+- All 17 headless expected-output tests passed after the configured-agent fixtures explicitly waited for Session persistence. The built CLI help/usage and keyless headless smoke cases also passed.
+- The steering replay passed all seven tests after merging the upstream accessible-name changes into the ARIA goldens. Turn-tail presentation passed nine tests with one record-only skip after correcting the Compact-mode selector. Those Session recordings were not refreshed. Separately, the goal-action fixture owner refreshed the current v4 header's `startsSeries: true` field and passed replay; no older Session generation was rewritten.
+- Settings and desktop-locale checks passed all 16 tests after updating the upstream labels and default choices while retaining contextual accessible names and focus assertions.
+- On 2026-09-29 (Asia/Shanghai), the companion/core assembled lane passed all five tests across Chromium, Firefox, and WebKit with clean core `1e53eedb532a7965aee4d4c294c2ee313cf15906` and companion `20b3b151858d9b9e6cb986501c00faf6960eb1b6`. The browser records identify both revisions. This paragraph and later documentation-only updates were not part of that tested companion revision.
+- On the same clean revisions, the core AT lab (`none 1000`), companion AT lab (`none 500`), and live-announcement lab (`complete none 500`) each passed startup and cleanup. These smoke runs did not launch a screen reader or exercise human tasks; the live lab smoke did not consume a replay.
+- The final full GUI run passed all 590 files: 9,274 tests passed and one was explicitly skipped. An earlier aggregate run had a Markdown-registration timeout; the final run passed without concurrent heavy jobs, retries, or timeout changes. The earlier failure is not counted as a pass, and its cause is not established.
+- General Web replay was checked in partitions, not a single final all-green aggregate. The remaining 144-file run initially had 21 failing files; repairs were verified in their owning files, with the final three-file partition passing all 12 tests. Reviewed changes cover upstream labels/defaults, keyboard/focus behavior, independent Fetch links, tooltip capture scope, and ARIA goldens. No blanket golden update or timeout relaxation was used.
+
+The companion CI pins the exact rc.2 core commit above, rather than a moving branch or historical tag. User-perceivable core UI changes require designer or product review before merge. The candidate remains unpublished.
+
+## Separate preview investigation
+
+An isolated, private temporary copy of the companion also passed installation, build, peer checks, host/client type checks, and all 236 tests against npm `0.2.0-rc.1` on 2026-09-28. Only the copy's DSH dependency pins, generated lockfile, release-age entries, and exact-version assertions were retargeted; the production component source was unchanged. The same Cordis and group versions were used. No candidate from that copy was published.
+
+This is a preliminary package/API result, not a migrated-core, assembled-browser, or assistive-technology result. The real branch still requires exact `0.1.7-rc.2` and rejects a `0.2.0-rc.1` core at the assembled-lab preflight. Do not install it into the preview using a version exemption or reinterpret the old human campaign as preview evidence.
+
+## Acceptance
+
+The candidate requires a migrated core, the complete exact dependency graph, host/client type checks, component regressions, build/package checks, and assembled Chromium/Firefox/WebKit results. Keyboard navigation, modal focus, explicit reading-view admission and clearing, pending input, permission decisions, and live announcements must retain their prior guarantees.
+
+Neither automated browser results nor successful lab startup establish spoken output, real accessibility-API mappings, or independent task completion by disabled developers. Human evidence remains empty until consented observations are submitted and reviewed. npm publication is not part of the migration checks.