# 0.4.0 RC evidence — 2026-10-03

Status: **0.4.0 RC READY** for owner review. This is an unpublished local RC, not a released npm version.

Integration update, 2026-10-04: [PR #1](https://github.com/lemonxiny55/dsh-composition-doctor/pull/1) and [Hosted CI evidence](0.4.0-hosted.md). All six Windows/Ubuntu × Node 20/22/24 jobs passed on implementation commit `063d7a8`; only CI isolation and golden newline release blockers were fixed after the initial RC. The local checks below remain dated evidence for the original artifact, not a claim about a later merged-main tarball.

## Baseline and scope

- Repository: `lemonxiny55/dsh-composition-doctor`.
- Fetched GitHub `main`, starting from clean `2daf2fa20930af402dc591d5f2049878d293b42c` (0.3.0). Local branch: `codex/failure-explainer-040`.
- Final scope: six bounded failure patterns; `diagnose` with file/stdin logs and human/JSON/Markdown output; a small `check` alias; additive report/Explorer explanations; public regressions and adoption assets.
- The explainer uses the existing normalized composition graph and diagnostic evidence. It does not create a second composer. Static syntax identifies insert/update declarations; public composition remains opt-in.
- At the initial 2026-10-03 checkpoint, no publication, remote push or PR was performed. Subsequent branch/PR integration is recorded in the update above. npm, tags, GitHub Release and Discussion remain unpublished.

## Demand and regression sources

[DSH #2889](https://github.com/deepseek-ai/deepseek-harness/discussions/2889) documents manual insertion plus bundle promotion and duplicate loading. [#6539](https://github.com/deepseek-ai/deepseek-harness/discussions/6539) supplies unavailable-bundle, missing packaged patch and missing-target patterns. [#8199](https://github.com/deepseek-ai/deepseek-harness/discussions/8199) supplies the upgrade compatibility theme and a concrete peer range. The [public architecture](https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/architecture.md) and current official CLI harness establish patch precedence and whole-config semantics.

Five checked-in fixture profiles are minimal structural reconstructions, not original users' profiles or reproduced plugin runtimes. Public sources and adaptations are recorded in `test/fixtures/failures/cases.json`. The sixth pattern uses the existing composition/replacement harness. [Case details](../failure-cases.md).

## Quality gates actually run

Pinned pnpm: **10.17.1**. Dependencies installed with `--frozen-lockfile --ignore-scripts`. Ubuntu verification used an isolated source copy, verified official Linux Node archives and a controlled PATH in an existing Ubuntu **24.04.4 LTS / WSL** environment. Windows used the local Node **24.19.0** runtime. These are executed local checks, not GitHub Actions results.

| Environment | `pnpm test` | `pnpm typecheck` | `pnpm build` | `pnpm pack` | Packed fresh install |
|---|---|---|---|---|---|
| Windows / Node 24.19.0 | 151 passed, 7 skipped | PASS | PASS | PASS | PASS |
| Ubuntu / Node 20.19.5 | 151 passed, 7 skipped | PASS | PASS | PASS | PASS |
| Ubuntu / Node 24.19.0 | 153 passed, 5 skipped | PASS | PASS | PASS | PASS |

All runs: 27 test files; 26 passed, 1 explicitly skipped online-only file; no failing tests. The Failure Explainer suite contributes 48 tests, with further Web and current-release harness regressions in their existing suites.

Skip accounting:

- Windows: four unavailable historical DSH artifact tests, two Windows file-symlink tests (creation permission unavailable), one opt-in online resolver test.
- Ubuntu Node 20: six real-artifact tests without configured binaries, one opt-in online resolver test. Current DSH was deliberately installed only for Node 24 verification.
- Ubuntu Node 24: four unavailable historical DSH artifact tests and one opt-in online resolver test. Both filesystem symlink regressions execute and pass on Ubuntu.

Reproduction commands:

```sh
pnpm test
pnpm typecheck
pnpm build
pnpm pack
pnpm smoke:pack ./dsh-composition-doctor-0.4.0.tgz
pnpm demo:failure -- --fast
```

Set `DSH_DOCTOR_REAL_DSH_CURRENT_BIN` to the separately installed official `@deepseek-ai/dsh@0.2.0-rc.2/lib/bin.js` for current-release tests. `scripts/linux-rc-check.sh` records isolated Ubuntu checks using supplied verified Node archives and pinned pnpm. The machine-local full logs are in ignored `rc-artifacts/windows-node24.19.0.log`, `ubuntu-node20.19.5.log` and `ubuntu-node24.19.0.log`.

The final Windows tarball is `dsh-composition-doctor-0.4.0.tgz`. SHA-256:

```text
939b91329c7d2086feb3caa610a0171b6419dad98043c6bc6f4a589090e67d01
```

It contains 38 allow-listed package files: built host/client/CLI modules, manifest, patch, bilingual README, changelog and license. Fixtures, logs, tooling, caches and release drafts are excluded. Fresh-install smoke uses an empty temp project, installs the tarball with lifecycle scripts disabled, checks the actual installed `.bin` launcher, CLI version/help, file/stdin diagnosis, no-match, report export, host module export and browser bundle. Windows and Unix launchers both pass.

Verification exposed two shipping issues, now fixed: the missing Unix CLI shebang, and concurrent Windows cache publication when identical downloaded artifacts race. The cache fix accepts an already published identical regular file without unlinking the destination; the existing corrupt-cache regression remains passing and now runs eight concurrent requests.

## Current DSH compatibility

- npm registry `latest` and `next`, checked on 2026-10-03: **0.2.0-rc.2**. Fresh official artifact installation used lifecycle scripts disabled.
- **Verified public composition contract:** Windows and Ubuntu / Node 24.19.0. Actual `--version` and `--dump-config` tests check bundle/profile/home/CLI ordering, row replacement, whole-config semantics, source comments, stdout/stderr parsing, unmatched-target identities and inert `!!js` handling. The current reviewed structural golden is checked in.
- **Historical only:** 0.1.5-rc.1 / rc.2 goldens. No fresh claim is made for their missing artifacts.
- **Expected-compatible / experimental:** 0.2.1-alpha.1. It has not passed the real-artifact harness here.
- **Hosted verification, 2026-10-04:** all Windows/Ubuntu × Node 20/22/24 jobs passed, with exact current DSH tests on both Node 24 jobs and packed smoke on every job. See the linked hosted evidence for commit, run and skip accounting.
- **Runtime/plugin UI:** not-run / not observed. No third-party plugin runtime, route/hook ownership or Web registration is certified by the composition harness.

## Safety and explanation limits

- Logs only contribute recognized signatures and safe candidate ids. ANSI/raw lines, arbitrary commands, URLs, paths, secrets and log-claimed runtime versions are not trusted facts or persisted log content.
- Default diagnosis performs no network call, CLI launch, plugin import or lifecycle execution; a fetch spy and executable sentinel verify these boundaries. Static parsing treats JavaScript tags as inert.
- Log files/stdin and declared patch metadata have format/size/path bounds. Sensitive environment/token/credential/workspace/chat/session paths are refused. Invalid metadata produces an incomplete/unknown result, never a health certificate.
- Profile hashes and mtimes remain unchanged after default diagnosis and exports. Export directories inside the canonical profile, symlink parents into it and linked report destinations are rejected.
- A normal update and a patched provenance chain are not independent insertions. Static duplicates remain static even when a public dump exposes only one final row. No evidence produces `unknown`; unsupported logs produce explicit `no-match` and a next step.
- Default inventory excludes home/CLI overlays, installation-level bundles and external workspace links. A locally unresolved package or absent insertion can still exist in those layers. `--composed` reuses the existing copied-profile adapter and its actual coverage/fallback.
- A DSH-family peer mismatch needs an independently selected exact host version. Host exemptions and policies are unknown; Doctor does not guess a compatible plugin release or bypass the gate.
- Prior effective values, field ownership, route/slot/hook ownership and runtime effects remain unknown. An explicit replacement fact proves replacement; a source chain proves patching. Static omitted keys do not prove runtime data loss.

## Reviewable adoption assets

- [English README](../../README.md) / [Chinese README](../../README.zh.md): symptom-first onboarding, actual output excerpts and two sourced cases.
- [Demo assets](../demo/README.md): complete human/JSON/Markdown captures and a reusable one-screen card.
- [25-second terminal script](../../scripts/failure-demo.mjs): two actual built-CLI fixture diagnoses.
- [GitHub Release draft](../release-drafts/0.4.0-release.md).
- [English DSH Discussion draft](../release-drafts/0.4.0-discussion.md).

All publication remains for the owner's explicit decision.