[Haoming9527]

Closes #386
Closes #387
Closes #375

What was wrong

Session creation and sandbox-mode events could register or dispose ops_bash while the host was still publishing a session append. The host rejected the nested append and left the new scope without Bash. Separately, DSH 0.2.1-rc.3 supplies text-only PromptPresentation values to the assembly waterfall; reading result.tools.length crashed an active PTC scope before its first step.

The change

Coalesce Bash lifecycle notifications into the next event-loop turn, keep unchanged registrations, check live authority in retained callbacks, and cancel queued publication on unload. Await publication during agent creation and rebuild a first prompt that took its schemas before a pending publication. Disposal requested by an append observer also defers registry writes. Distinguish the text-only waterfall from complete PTC assembly probes: the latter still require exactly one run_code schema and the PTC instruction.

Add a cold-start regression for the readiness-order fix already merged in #366: hold discovery startup pending while the first prompt assembles, then require that first prompt to succeed after the selected replacement publishes. This closes #375 by preserving its existing implementation fix.

This follows #383, whose commits are included here. The base is main so the existing pull-request workflow branch filter runs; merging #383 first will narrow this PR's diff automatically. No new dependencies, version changes, tool schemas or argument contracts.

Validation

• Before the fix, node test/run.mjs session-lifecycle failed 2/2 assertions: nested-append registration rejection and the exact Cannot read properties of undefined (reading 'length') error.
• The strengthened real-SessionStore test was red against the initial follow-up because awaited creation did not include deferred publication. Final head edf70d8 passes 3/3 lifecycle assertions, including actual append reentry protection, deferred disposal, retained-callback authority and first-prompt readiness. The host guard is a synchronous per-session boolean reset in finally, not async-local state.
• Reverting fix(hide-official): stop gating run_code scopes on native readiness #366's implementation made the cold-start test fail with READINESS_BLOCKED: missing OPS surface; restoring it passed.
• Final focused verification: 7 suites / 56 assertions passed, 0 skipped, 0 failed (authority 12; component-migration 3; official-tool-hiding 29; session-incremental 2; session-lifecycle 3; shells-incremental 2; shells-session 5).
• Initial full local verification: 5 failures and 4 skips among 136 suites. Three failures were resolved by the publication ordering change and restoration of the exact locked optional host resolver helper. The Bash IPC timeout passed on its single designated recheck at the CI's 300-second deadline: 8/8 assertions, 0 skips, 199 seconds. The permissions suite still exceeded the local deadline, including a coordinated recheck; its printed assertions do not count as a passing suite. The four full-run skips were Linux-only attributes/shell and optional external TUI host/native fixtures.
• Typecheck and source-size checks passed. Required pull-request CI on edf70d8: run 40112481896; all checks passed, including Linux, macOS, Windows, Node floor, source-size, tools trial, workflow lint and the required aggregate.
• Paired discovery documentation and Unreleased changelog updated.

The rc.3 change covers this prompt hook contract. It does not declare every rc.3 host API compatible: selected hide-official replacement still fails closed where the new host withholds its authoritative schema snapshot from the waterfall. No Desktop GUI timing or #359 indefinite-stall resolution is claimed.

Environment

Windows x64, Node v26.12.1 for the initial full run and v24.19.0 for final focused rechecks, Rust cargo 1.99.0; source checkout based on #383 refreshed head fe06fa4, which includes main 662a388. Native source is this exact branch, built in its private native/target; Bash fixture is the pinned @dsh-ops/[email protected] payload.

[Thatgfsj]

复审无误，批准合并