review fix: trim duplicate closure evidence

apps/cli/reference/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/reference/README.md
-README.md: c6c3f61c2910b84b9364ef7eaa13b8c0c011999b
-README.zh.md: d6f3e7f1f508724e54e59df01e93199193ddc506
+README.md: f95973c05401d73a70db07b6ea4c76cd16f406f3
+README.zh.md: aa8a877bc53e430c867d384a2b0653255db5079d

apps/cli/reference/README.md

@@ -49,7 +49,7 @@ dsh plugin --profile <name> add @deepseek-ai/dsh-subagent-claude-code
 dsh plugin --profile <name> remove @deepseek-ai/dsh-subagent-claude-code
 ```
 
-The successful pnpm operation changes the Profile manifest and Bundle list on disk; a running Profile keeps the Bundle set from its current start. Restart that Profile after adding, removing, or updating the Bundle. This startup boundary applies to Bundle membership, while ordinary edits to the Profile or home `cordis.patch.yml` take effect through hot reload. On the next start, the installed package registers only its dormant Host provider and starts no Claude process. The Bundle installs the pinned Agent SDK and one matching private platform CLI, uses only that CLI, and never falls back to a host `claude`. Authentication and native Claude settings remain user-managed; the [Claude Code provider README](../../../packages/subagent/subagent-claude-code/README.md) discloses the current platform payload size and missing-payload failure. Full Agent Presets keep both product tool rows disabled, so a copied Preset must separately enable the Claude Code row before a new Agent can see that tool. The Codex provider remains an explicitly mounted Host plugin that resolves `codex` from `PATH`; the default dsh dependency closure includes neither provider nor the Claude Agent SDK or its platform payloads.
+The successful pnpm operation changes the Profile manifest and Bundle list on disk; a running Profile keeps the Bundle set from its current start. Restart that Profile after adding, removing, or updating the Bundle. This startup boundary applies to Bundle membership, while ordinary edits to the Profile or home `cordis.patch.yml` take effect through hot reload. On the next start, the Bundle registers its dormant Host provider; a copied Preset must separately enable the matching tool row for new Agents. The [Claude Code provider README](../../../packages/subagent/subagent-claude-code/README.md) owns executable, authentication, payload, and failure details; the [subagent package reference](../../../packages/subagent/README.md) owns the current Codex deployment path; and the [base Bundle reference](../../../packages/bundle/base/README.md) owns the default dependency closure.
 
 ```sh
 dsh plugin --profile tui add github:deepseek-harness/turtle-ui

apps/cli/reference/README.zh.md

@@ -49,7 +49,7 @@ dsh plugin --profile <name> add @deepseek-ai/dsh-subagent-claude-code
 dsh plugin --profile <name> remove @deepseek-ai/dsh-subagent-claude-code
 ```
 
-pnpm 操作成功后只会改变磁盘上的 Profile manifest 与 Bundle 列表；正在运行的 Profile 会保留本次启动时的 Bundle 集合。添加、移除或更新 Bundle 后须重启该 Profile。这个启动边界只适用于 Bundle 成员变化，Profile 或 home 中普通 `cordis.patch.yml` 的编辑通过热重载生效。下一次启动时，已安装的包只注册休眠的 Host provider，不会启动 Claude 进程。该 Bundle 会安装锁定的 Agent SDK 与一个匹配的私有平台 CLI，只使用该 CLI，并且绝不会回退到宿主 `claude`。Claude 的身份验证与原生设置仍由用户管理；[Claude Code provider README](../../../packages/subagent/subagent-claude-code/README.md)会披露当前平台载荷体积与载荷缺失时的失败行为。完整 Agent Preset 中的两个产品工具行仍默认禁用，因此还须在复制出的 Preset 中单独启用 Claude Code 行，新 Agent 才能看到该工具。Codex provider 仍须作为 Host 插件显式挂载，并从 `PATH` 解析 `codex`；默认 dsh 依赖闭包不包含任一 provider，也不包含 Claude Agent SDK 或其平台载荷。
+pnpm 操作成功后只会改变磁盘上的 Profile manifest 与 Bundle 列表；正在运行的 Profile 会保留本次启动时的 Bundle 集合。添加、移除或更新 Bundle 后须重启该 Profile。这个启动边界只适用于 Bundle 成员变化，Profile 或 home 中普通 `cordis.patch.yml` 的编辑通过热重载生效。下一次启动时，Bundle 会注册休眠的 Host provider；还须在复制出的 Preset 中单独启用对应工具行，新 Agent 才能看到该工具。[Claude Code provider README](../../../packages/subagent/subagent-claude-code/README.md)负责可执行文件、身份验证、载荷与失败细节；[subagent 包参考](../../../packages/subagent/README.md)负责当前 Codex 部署路径；[base Bundle 参考](../../../packages/bundle/base/README.md)负责默认依赖闭包。
 
 ```sh
 dsh plugin --profile tui add github:deepseek-harness/turtle-ui

scripts/verify-cordis-config.spec.ts

@@ -4,10 +4,9 @@
  * metadata field must stay static, and a disabled expression must parse.
  */
 
-import { globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
 import {
   bundleManifestPaths,
@@ -15,36 +14,6 @@ import {
   metadataExpressionErrors,
 } from './verify-cordis-config.ts'
 
-interface WorkspaceManifest {
-  name?: string
-  dependencies?: Record<string, string>
-  optionalDependencies?: Record<string, string>
-  peerDependencies?: Record<string, string>
-}
-
-const repoRoot = fileURLToPath(new URL('..', import.meta.url))
-
-function productionClosure(entry: string): Set<string> {
-  const manifests = new Map<string, WorkspaceManifest>()
-  for (const path of globSync(['apps/*/package.json', 'packages/*/*/package.json'], { cwd: repoRoot })) {
-    const manifest = JSON.parse(readFileSync(join(repoRoot, path), 'utf8')) as WorkspaceManifest
-    if (manifest.name !== undefined) manifests.set(manifest.name, manifest)
-  }
-  const visited = new Set<string>()
-  const pending = [entry]
-  for (let name = pending.pop(); name !== undefined; name = pending.pop()) {
-    if (visited.has(name)) continue
-    visited.add(name)
-    const manifest = manifests.get(name)
-    pending.push(
-      ...Object.keys(manifest?.dependencies ?? {}),
-      ...Object.keys(manifest?.optionalDependencies ?? {}),
-      ...Object.keys(manifest?.peerDependencies ?? {}),
-    )
-  }
-  return visited
-}
-
 describe('verify-cordis-config metadata expressions', () => {
   it('accepts a disabled !!js expression', () => {
     const problems = metadataExpressionErrors(
@@ -116,15 +85,4 @@ describe('workspace Bundle discovery and product dependency closures', () => {
       `${file}: @deepseek-ai/dsh-missing-plugin must be declared in ${manifestPath} dependencies`,
     ])
   })
-
-  it('keeps the default and optional Claude Code closure independent', () => {
-    const shipped = productionClosure('@deepseek-ai/dsh')
-    expect(shipped).not.toContain('@deepseek-ai/dsh-subagent-codex')
-    expect(shipped).not.toContain('@deepseek-ai/dsh-subagent-claude-code')
-    expect(shipped).not.toContain('@anthropic-ai/claude-agent-sdk')
-
-    const claudeCode = productionClosure('@deepseek-ai/dsh-subagent-claude-code')
-    expect(claudeCode).toContain('@anthropic-ai/claude-agent-sdk')
-    expect(claudeCode).not.toContain('@deepseek-ai/dsh-subagent-codex')
-  })
 })