# DSH 0.1.7-rc.1 compatibility build

This directory pins upstream `dsh-v0.1.7-rc.1` by its immutable commit and hashes of every modified source file. The compatibility patch adds `sessions.openingAccess`, an async fail-closed gate run before a retained Session requests its opening history. The Vault client registers one gate and supplies the authoritative workspace id from the workspace catalog; missing or failed state checks reject the open.

`build-compat.mjs <output-dir> <source-archive>` unpacks the source into a fresh temporary tree, verifies its complete Git tree against the tree of the pinned upstream commit, then checks the version and every modified source preimage. The compatibility patch gives Lightning CSS a repository-relative filename for CSS Modules, and the builder replaces the temporary source root in emitted JavaScript with `/dsh-source`. Together these steps keep class names and module labels stable across operating systems and random temporary directories. The builder installs the lockfile, builds host libraries and the four affected browser bundles, and requires their hashes to match this directory's committed `verification.json`. It also verifies the compatibility patch hash. Archive compression metadata is not treated as source identity.

The compatibility patch declares Workspace row action/accessory and title chains, Session row title, Conversation title and guard, and browser document-title slots. Real Workspace rows carry stable `workspaceId` values; a locked Workspace inherits protection to its sessions, while ungrouped sessions receive no Workspace action. Vault uses these slots to conceal protected names in the sidebar, Conversation header, and browser title, and to place an unlock guard over protected content. The separate `dsh-vault-client-bundles-dsh-v0.1.7-rc.1.tgz` release asset must be deployed to the matching DSH global client packages after the Web profile is stopped; reinstalling only the Vault plugin does not update those host bundles. Back up the four existing `lib/client.js` files before replacement. Restart through the normal DSH launcher and verify Workspace row locking, title concealment, and unlock in the browser. The access gate protects browser navigation before history fetch. It is not server authorization and does not encrypt DSH's conversation database.