[viztor]

Phase P-T1a of docs/improvement-plan.md. It is stacked on #108 (P2), which sits on #107, #106 and #105.

After this PR, the test install runs the host users run (D14, D22). It is a pinning phase, so no src/ behaviour changes.

What is pinned

	Before	After	Why
@earendil-works/pi-ai	1.3.0	1.1.0 + the harness's patch	The harness's own lockfile pins 1.1.0 and patches it. A pnpm overrides entry holds every copy in the tree to it, including the one dsh-llm-pi-ai's ^1.1.0 would otherwise float. The patch is copied verbatim into patches/, and its hash matches the one the harness lockfile records.
@deepseek-ai/*	0.2.1-alpha.5	0.2.1-rc.2 (cordis 4.0.5, loader 1.0.6, schemastery 3.18.5)	This is what a registry install of the published dsh resolves. The rc.2 builds of llm-pi-ai, cordis and schemastery have the same code as alpha.5; only their package.json ranges differ.
new devDependencies	—	dsh-llm, dsh-app-boot, dsh-config-editor, dsh-settings, cordis-plugin-loader	The next phase, P-T1b, builds its real-host harness on these. This phase only installs them and version-tests them.

minimumReleaseAgeExclude is now empty. Every pinned version is older than pnpm's 24-hour release-age window, so nothing needs that window lifted.

Tests

• test/support/host-versions.ts names the pinned versions once.
• test/host-versions.test.ts checks four things:
  1. The pi the plugin loads at runtime (loadHostPi) is 1.1.0, and it is the same module instance the tests import.
  2. The lockfile holds exactly one pi, and it is 1.1.0.
  3. A known context line from the harness patch is present in the installed dist, and the lines the patch removes are absent.
  4. The installed @deepseek-ai cluster matches the pinned versions, within the plugin's own declared ranges.
• test/mount-protocols.test.ts is rewritten. It now checks that every catalog SDK maps to a protocol that pi's exported api/* modules implement. It keeps a characterization row: pi 1.1.0's opencode-go provider has no Google API (F10). That gap is what the plugin's provider fills in P-R1.
• test/harness-channel.test.ts reads the channel from HOST_VERSIONS instead of an alpha-channel regex.
• test/no-local-paths.test.ts now also scans patches/ and pnpm-workspace.yaml.

Review

The change went through three review lenses (correctness and host contracts, tests, repository rules), and two independent skeptics checked each finding. Over three rounds, every upheld finding was fixed: 3 medium and 21 low.

Verification

All run locally:

Node	Step	Result
26	pnpm install --frozen-lockfile	lockfile up to date
26	pnpm run check	0 errors; 21 warnings, unchanged from the base
26	unit suite	1241 tests pass, up from 1234
26	shuffled, seeds 1 / 42 / 1234	pass
26	test:mock	51 pass
26	build and scripts/check.ts	pass. The consumer install resolves no pi of its own, because the package has no pi dependency.
26	coverage	96.4% lines
24	shuffled (seed 7) and test:mock	pass

The diff and the patch file contain no local paths.

Note on CI: the catalog freshness check will fail here for the reason described on #108. The vendor added a Go model (kimi-k3.1-pro), and this PR doesn't touch the catalog. The nightly refresh fixes it.

---

Generated by Claude Code

[viztor]

catalog freshness is red for the same reason as on #108: the vendor catalog added a Go model (opencode-go: 28 -> 29, + kimi-k3.1-pro). This PR doesn't touch src/catalog-data.ts or its generator.

No fix exists yet. The shim needs pnpm run catalog:shim -- --write, run with network access to models.opencode.ai. The repository's nightly run will open the refresh PR against main. Once that merges, main gets merged up through this stack. The other checks on this commit are unaffected.

---

Generated by Claude Code